Authentication
How to authenticate API requests.
How to authenticate API requests.
| Token type | Used for | Header | Source |
|---|
| Platform token | Project management | Authorization: Bearer TOKEN | Management API |
| Anon key | Public auth endpoints | Authorization: Bearer KEY | Project settings |
| Access token | User operations | Authorization: Bearer TOKEN | Signup/signin |
| Service key | Admin operations | Authorization: Bearer TOKEN | Create via API |
| Property | Value |
|---|
| Purpose | Signup, signin, refresh, logout |
| Source | Project Settings → Authentication → Anon Keys |
| Safe to expose | Yes (in frontend code) |
| Scope | Single project |
POST /auth/signup
Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...
| Property | Value |
|---|
| Purpose | Invoking functions, accessing user profile |
| Source | Signup/signin response (access_token field) |
| Lifetime | 1 hour (configurable) |
| Contains | user_id, email, project_id, role |
POST /functions/func-id/invoke
Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...
| Property | Value |
|---|
| Purpose | Managing projects, functions, databases |
| Source | Management API (port 8001) |
| Scope | Your account (all projects) |
GET /projects
Authorization: Bearer 64-character-hex-string...
| Property | Value |
|---|
| Purpose | Background jobs, cron, webhooks |
| Source | POST /projects/{id}/service-keys |
| Scope | Single project |
| User context | None (functions don't receive __volcano_auth) |
POST /functions/func-id/invoke
Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...
All use Bearer authentication:
Authorization: Bearer <token>
Don't include:
- Extra quotes
- "Token" prefix
- Line breaks
| Status | Cause |
|---|
| 401 Unauthorized | Missing Authorization header, invalid token, expired token, or token for wrong project |
| 403 Forbidden | Valid token but no permission, CORS blocked, anon key revoked, or account banned |
