Authentication

How to authenticate with AuthSpoke — obtain a JWT bearer token and use it on every request.

AuthSpoke authenticates API calls with a JWT bearer token. You obtain one by signing in, then send it on every authenticated request.

Which host? You register once at the apex https://authspoke.com, which provisions your tenant and returns your tenant URL — a https://trial-######.authspoke.com subdomain, brandable to a custom domain like https://your-company.authspoke.com. Sign in and make all human/admin calls against your tenant URL. Machine-to-machine clients instead call the stable headless host https://api.authspoke.com, where the tenant is derived from the token (see API Tokens). Examples use your-company.authspoke.com — substitute your own subdomain.

Obtain a token#

curl -X POST "https://your-company.authspoke.com/api/v1/auth/signin" \
  -H "Content-Type: application/json" \
  -d '{"username":"[email protected]","password":"••••••••"}'

{ "token": "eyJhbGciOiJIUzI1NiJ9..." }

Use the token#

Send it in the Authorization header:

curl "https://your-company.authspoke.com/api/v1/ai/agents" \
  -H "Authorization: Bearer eyJhbGciOiJIUzI1NiJ9..."

What the token carries#

The JWT encodes the subject (username), the user id and the tenant context. Tenant-scoped endpoints derive the tenant from the token — you never pass a tenant id for your own data, and you cannot read another tenant's data with your token.

Public vs. authenticated endpoints#

A small set of endpoints are intentionally public (no token):

POST /auth/signin, POST /auth/reset-password, GET /auth/ping
POST /register, POST /email/send-otp, POST /email/verify-otp
Health probes: GET /agents/health, GET /monitor/ping

Everything else requires a valid bearer token. The API Reference marks each endpoint accordingly.

Capability enforcement#

Holding a valid token is necessary but not always sufficient. Some endpoints also require a Capability SKU to be licensed for your tenant (for example, the Identity endpoints require Identity Foundation). If the capability is not licensed, the API returns 403 capability_not_licensed — enforced server-side. See Capability SKUs.

Supported & planned mechanisms#

Today: JWT bearer. On the roadmap: OAuth2 / OIDC, Personal Access Tokens, API keys, mTLS and short-lived workload tokens — see API Tokens.

Errors#

A missing or invalid token yields 403. See Errors & Status Codes.