API Tokens

Every AI agent and automation needs credentials. AuthSpoke manages them centrally so secrets are never embedded in agent configuration.

Today: JWT bearer tokens#

The supported mechanism is the JWT obtained from POST /auth/signin. It is short-lived and carries tenant context.

Roadmap: managed API tokens#

A dedicated token-management surface is coming. Each token will carry:

• Name, description, owner and associated agent
• Scopes, allowed APIs and allowed MCP servers
• Expiration, last-used, created-by and environment
• IP restrictions, rotation policy and risk
• Full audit history

You'll be able to create, rotate, disable, suspend, expire, revoke and clone tokens.

Secure by default. A token's secret is shown exactly once, at creation. AuthSpoke stores only a hash — it can never be displayed again. Rotate rather than reuse.

Best practices#

• Prefer short-lived tokens and rotate on a schedule.
• Scope every token to the minimum APIs and MCP servers it needs.
• Store secrets in a vault, not in code or agent config. See Secrets.
• Treat a leaked token as compromised: revoke, rotate, and review the audit trail.

When managed tokens ship, they'll appear in the API Reference automatically — the reference is generated from the OpenAPI spec, so it never drifts from the implementation.