Authentication

Account session#

The web console uses a short-lived access JWT and rotating refresh token. Send the access token as a bearer token only to console endpoints: /v2/projects, /v2/api-keys, /v2/provider-catalog, and everything under /console/v2/.

401 may mean the access token expired. The first refresh rotates both tokens; concurrent console requests share that refresh and retry once. A 403 is an authorization decision and must not trigger token refresh.

Project API key#

Machine endpoints use:

X-Api-Key: dvk_...

The key identifies its project on the server. Do not send a different project ID in a body and expect it to widen access. Keep the plaintext in a server-side secret manager. Never embed it in JavaScript shipped to a browser, a mobile bundle, a public repository, logs, or analytics.

Keys are stored as hashes. Creation is the only response that contains the plaintext; revoke and replace a lost key. A project key presented to a /console/v2/ route authenticates nothing.