Authentication

The public API authenticates with personal access tokens (PATs) sent as a bearer header:

Authorization: Bearer dxdt_...

curl -s https://<your-dxdt-host>/api/v1/me \
  -H "Authorization: Bearer $DXDT_TOKEN"

Creating tokens

Two ways:

1. dxdt login — browser flow; mints a token automatically and stores it for the CLI.
2. Settings → CLI & API in the web app (or POST /api/v1/tokens from an existing browser session) — for CI and integrations.

Tokens are shown once at mint time and stored only as a hash — copy them immediately. Minting always requires an interactive (browser) session: a token can never create another token.

Token properties

Property	Behavior
Format	dxdt_ + 43 URL-safe random characters
Binding	Pinned to the minting user and tenant — requests can never widen to another tenant (403)
Scope	read or read_write (see below)
Expiry	Optional; set at mint time
Revocation	dxdt tokens revoke <id>, the web app, or DELETE /api/v1/tokens/{id} — immediate
Audit	Mint and revoke are recorded in the tenant audit trail

Scopes

• read — safe (GET) endpoints only. May not invoke the agent: agent runs can execute tools with side effects, so method-gating alone isn't sufficient.
• read_write — everything read allows, plus mutations and agent invocation (/api/v1/ask, /api/v1/stream).

Grant read to dashboards and reporting jobs; reserve read_write for tooling that genuinely drives the agent or mutates state.

Budgets

Agent invocations are capped per token per UTC day. Exceeding the budget returns 429 for further agent calls until the day rolls over — non-agent endpoints keep working. This is a cost backstop for tokens running in cron/CI; contact support to raise a tenant's limit.

Errors

Status	Meaning
401	Missing, invalid, expired, or revoked token — invalid tokens are always a hard 401, never a fall-through
403	Valid token, but insufficient scope or a cross-tenant request
429	Daily agent budget exhausted for this token