Authenticate API requests

Send your personal API token as a bearer header on every request. There is no public endpoint and no anonymous mode.

curl -H "Authorization: Bearer asob_…" \
  https://your-host/api/backend/health

const response = await fetch("https://your-host/api/backend/health", {
  headers: { Authorization: `Bearer ${process.env.ASOBEAST_API_TOKEN}` },
});
const health = await response.json();

import os, requests

response = requests.get(
    "https://your-host/api/backend/health",
    headers={"Authorization": f"Bearer {os.environ['ASOBEAST_API_TOKEN']}"},
)
health = response.json()

Two credential types

Credential	Used by	Obtained from
Session cookie	The dashboard in a browser	Signing in. The proxy forwards it for you
Personal API token	Scripts, the MCP server, continuous integration	The API tokens card in Settings

Both carry the same access and the same entitlement checks. A token is not a reduced credential, so give each consumer its own and revoke individually. See Personal API tokens.

Status codes you will see

Status	Meaning
`401`	The credential is missing, malformed, revoked or signed with a rotated secret
`402`	The account is not entitled, which only happens when `BILLING_ENABLED` is `true`
`404` on `/docs` or `/admin/queues`	You are not an owner. These surfaces answer `404` rather than confirming they exist

A 401 after a deployment usually means AUTH_SECRET was rotated, which invalidates sessions. Personal API tokens survive a rotation, because they are stored as hashes rather than signed. See Rotate secrets.

Keep the token out of your history

Read it from an environment variable rather than typing it into a shell.

export ASOBEAST_API_TOKEN=asob_…
curl -H "Authorization: Bearer $ASOBEAST_API_TOKEN" \
  https://your-host/api/backend/apps

Error responses

The envelope every failure returns.

Authentication and accounts

Sessions, guards and entitlements.

Overview

Endpoints

Authenticate API requests

Two credential types

Status codes you will see

Keep the token out of your history

Error responses

Authentication and accounts

​Two credential types

​Status codes you will see

​Keep the token out of your history

​Related

Error responses

Authentication and accounts

Two credential types

Status codes you will see

Keep the token out of your history

Related