Authentication

How tokens work, what they can reach, and how to revoke one.

Reference endpoints take no credential. Client endpoints take a bearer token.

authorization: Bearer epr_3f8c…

What a token can reach

Only the account it was issued to. The client identifier is derived from the token itself and is never read from the request, so there is no parameter to change that would reach another account.

How we store it

As a SHA-256 digest. We cannot show you a token again after it is issued, and a dump of our storage yields nothing usable.

Revoking

Removing the dashboard user revokes every token issued to them, on the next request. Ask us and we will rotate one.