Skip to main content
Every /v1 request carries a bearer token:
There are three token types, each for a different caller.
Only an abs_… agent session can read or mount secret values via the /v1/access/* endpoints. Operator sessions and personal API keys manage the control plane but can never reveal a secret.

​
Human operators

The authentication system handles operator identity at /api/auth/*. Sign in to obtain a session token (or browser cookie), then use it as the bearer for /v1 management endpoints. See Human authentication for the route list and the CLI device flow.

​
Personal API keys

A personal API key (abu_…) lets a user script the management surface without a browser. Each key is bound to a (user, org) pair and is created, listed, and revoked from the dashboard’s org Settings page or via the POST /v1/api-keys endpoint.
A personal API key is structurally barred from /v1/access/*: it can never reveal or mount secret values, and it cannot create or revoke other API keys. Reading secrets still requires a keypair agent plus an explicit permission. The secret is shown exactly once at creation — the server stores only a SHA-256 hash and an 8-character lookup prefix.

​
Agents

Agents authenticate with short-lived Ed25519 keypair sessions. The session token (abs_…) is opaque, hashed at rest, and expires after 15 minutes. It is the only credential that reaches /v1/access/*.

​
Session lifecycle

1

Register

An operator registers the agent (POST /v1/agents) with a public key, or requests a one-time abe_… bootstrap token.
2

Enroll

A bootstrapped agent redeems its token and uploads its public key (POST /v1/agents/enroll).
3

Challenge

The agent requests a signing challenge (POST /v1/agents/{agentId}/sessions/challenge, abc_…, 60-second TTL).
4

Exchange

The agent signs the challenge and exchanges it for an abs_… session token (POST /v1/agents/{agentId}/sessions/exchange, 15-minute TTL).
5

Refresh

The SDK re-runs the exchange at T-2 minutes before expiry; no long-lived secret is ever stored on disk.

​
Token defaults

​
Authorization header examples

​
Auth audit events

Every auth lifecycle event is recorded in the audit log: auth.login, auth.logout, agent.bootstrap_issue, agent.enroll, agent.session_issue, agent.session_reject, agent.session_revoke. See Audit log for the full catalog.