AuthSpokeAuthSpoke Developers

Provision & Authenticate

Create a tenant, sign in for a human JWT, and issue machine credentials for agents, SDKs and CI.

Everything in AuthSpoke is tenant-scoped and requires a token. This guide gets you from nothing to two working credentials: a human JWT (for console/admin work) and a machine token (for agents, SDKs, CI).

1. Register a tenant#

Self-service registration creates a trial tenant and its first SUPER admin. On environments with OTP disabled, it completes without an email round-trip.

curl -X POST "https://authspoke.com/api/v1/register" \
  -H "Content-Type: application/json" \
  -d '{
    "username": "acme-admin",
    "password": "S3cur3-Pass!",
    "email": "[email protected]",
    "firstName": "Acme",
    "lastName": "Platform",
    "country": "US",
    "state": "CA"
  }'

You receive a trial-###### tenant. You can brand it later with a custom subdomain alias via PUT /api/v1/tenant/domain/alias.

2. Sign in (human JWT)#

export TOKEN=$(curl -s -X POST "https://your-company.authspoke.com/api/v1/auth/signin" \
  -H "Content-Type: application/json" \
  -d '{"username":"acme-admin","password":"S3cur3-Pass!"}' | jq -r .token)

Use $TOKEN for all tenant-scoped calls: Authorization: Bearer $TOKEN.

3. Issue a machine credential#

Agents and automation must never use a human password. Mint an API key — the secret is returned exactly once and is never recoverable.

curl -s -X POST "https://your-company.authspoke.com/api/v1/api-keys" \
  -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" \
  -d '{"name":"ci-pipeline","scopes":"ai:read ai:write"}'

{
  "clientId": "ak_…",
  "clientSecret": "sk_…",     // save now
  "name": "ci-pipeline",
  "scopes": "ai:read ai:write",
  "tokenUrl": "https://api.authspoke.com/api/v1/auth/token"
}

4. Exchange the key for a machine token#

This is the client-credentials grant a real agent performs. Note the api. host — it is stable and tenant-independent (the tenant comes from the key).

export M2M=$(curl -s -X POST "https://api.authspoke.com/api/v1/auth/token" \
  -H "Content-Type: application/json" \
  -d '{"clientId":"ak_…","clientSecret":"sk_…"}' | jq -r .access_token)

The machine token validates through the exact same path as a human JWT, so it works on every /api/v1/** endpoint the key's scopes permit.

5. Manage & revoke keys#

curl -s "https://your-company.authspoke.com/api/v1/api-keys" -H "Authorization: Bearer $TOKEN"          # list (secrets never shown)
curl -s -X DELETE "https://your-company.authspoke.com/api/v1/api-keys/$KEY_ID" -H "Authorization: Bearer $TOKEN"  # revoke

Revoking a key fails all future token exchanges immediately; already-issued JWTs expire on their own.

Next#