Authentication

All API requests require a bearer token.

Creating a token

Generate tokens in Settings → API Tokens of the web dashboard. See API Tokens for scope details.

Using a token

Include the token in the Authorization header:

Authorization: Bearer YOUR_TOKEN

Example

curl -X POST https://notify.yourdomain.com/api/notify \
  -H "Authorization: Bearer nfq_abc123..." \
  -H "Content-Type: application/json" \
  -d '{"title": "Test", "message": "Test message","level": "info"}'

Token scopes

Scope	Required for
notify	POST /api/notify
panel	Panel registration and SSE connection
metrics	GET /tenant-metrics

A token without an explicit scope restriction has access to all three.

Security notes

• Tokens are hashed before storage and cannot be retrieved after creation
• Revoke tokens immediately if compromised via Settings → API Tokens → Revoke
• Create one token per integration for targeted revocation