Authentication
Header format
Every request carries a Bearer token:
HTTP
Authorization: Bearer YOUR_API_KEYToken kinds
| Kind | Prefix | Obtained via | Recommended for |
|---|---|---|---|
| Personal Access Token (PAT) | avsk_live_ | Settings → API Access | Third-party integrations |
| OAuth2 access token | avs_at_ | POST /api/v1/oauth/token | The first-party mobile app only |
The OAuth2 password grant requires sending a user's own email and password directly to the token endpoint. That is not an appropriate pattern for a third-party integration — use a Personal Access Token instead.
Least-privilege rule
A token's effective permissions are always granted scopes ∩ the member's role permissions. A token can never do more than the underlying user's role allows — scopes only narrow access, they never widen it. See Permissions & Scopes.
Rotation & revocation
Personal Access Tokens can be revoked at any time from Settings → API Access. There is currently no one-click "rotate" action — create a new token, update your integration, then revoke the old one.
Security recommendations
- Store tokens in a secrets manager, never in source control.
- Use one token per integration so you can revoke individually.
- Grant the narrowest scopes the integration actually needs.
- Revoke immediately if a token may have leaked.