Get Started

Authentication

How requests to the Label platform API are authenticated and authorized.

Bearer tokens

Nearly every endpoint requires a bearer token. Pass it in the Authorization header on each request:

Authorization: Bearer <token>

Tokens are JWTs issued by the auth service. A request without a valid token receives a 401 Unauthorized; a valid token lacking the required permission receives a 403 Forbidden.

Obtaining a token

The auth endpoints below are public — they do not themselves require a token. Exchange credentials for an access token, then use that token for all other calls.

POST/api/v1/auth/loginExchange email + password for an access token.
POST/api/v1/auth/registerCreate a new account.
POST/api/v1/auth/tokenExchange or refresh a token.
POST/api/v1/auth/password-resetBegin a password reset flow.

API keys

For server-to-server integrations, create a long-lived API key in the dashboard under Settings → API Keys and present it as the bearer token. Manage keys programmatically with the API key endpoints:

GET/api/v1/api-keysList API keys for the account.
POST/api/v1/api-keysIssue a new API key.
DELETE/api/v1/api-keys/{id}Revoke an API key.

Keep keys secret

An API key carries your account's permissions. Store it in a secrets manager, never in source control, and revoke it immediately if exposed.

OAuth sign-in

Interactive applications can authenticate users through the hosted OAuth flow under /api/v1/auth/oauth/*. The flow returns the same bearer token used by the rest of the API.

Webhook authentication

Inbound webhook callbacks (for example training-completion notifications) are authenticated with a shared secret rather than a user token. See Notifications & Webhooks for signature verification.