Avura

Authentication

Authenticate programmatic requests with bearer API tokens.

Programmatic requests authenticate with an API token instead of a browser session. Create one from Settings → API tokens or via the tokens API (organization owners and admins can mint an org-wide token; anyone with manager access to a domain can mint a token pinned to that domain). The plaintext token is shown exactly once — store it somewhere safe.

Authorization: Bearer avk_5f2c1e9a...

Tokens carry two independent restrictions:

  • Scope — a read token may only call safe methods (GET/HEAD/OPTIONS); a write token may also call POST/PATCH/DELETE.
  • Domain pin — a token minted for a specific domain can only reach /api/domains, /api/dns, /api/external-dns, and /api/tokens, and only the subtree it was pinned to. Org-wide tokens (no domain pin) are not restricted by path.
curl https://avura.work/api/domains \
  -H "Authorization: Bearer avk_5f2c1e9a..."

A pinned write token can also delegate — minting, listing, and revoking child tokens strictly inside its own subtree. The containment rules (pin required, subtree-only, expiry clamped to the issuer) are covered in API tokens.