Appearance
Authentication & tokens
Every request needs an Anikeen ID access token in the Authorization header:
http
Authorization: Bearer <token>
Accept: application/jsonbash
curl https://console.anikeen.com/api/v1/zones \
-H "Authorization: Bearer $ANIKEEN_TOKEN" -H "Accept: application/json"Which tokens work
| Token | Works? | Acts as |
|---|---|---|
| Personal access token you create in Anikeen ID (Settings → API) | yes | you, in all your teams |
| OAuth access token of an app Anikeen trusts, for a user beta | yes, with console-* scopes only | the user, in the app's own team only - see Apps acting for users |
| OAuth access token of any other app | no: 401, error: client_not_allowed beta | - |
| Client-credentials token (no user) | no: 401 | - |
Who the token was issued to decides which scopes count. beta (In production today, OAuth access tokens issued by Anikeen ID to any app still work like a personal access token, with the same scopes.)
| Token issued to | Scopes that count |
|---|---|
| the Console itself, or a personal access token | user, user:read, products:read, * and the console-* scopes |
| an app Anikeen trusts beta | only the console-* scopes, only in the app's team |
| any other app beta | none (401 client_not_allowed) |
Requirements for your account
- Your Console account must be linked to the Anikeen ID account of the token: you signed in to the Console with Anikeen ID at least once. (For an app Anikeen trusts, the account is created on the app's first request.)
- Your e-mail address must be verified in Anikeen ID.
Lifetime and revocation
- A personal access token is shown once when you create it.
- It expires after 6 months.
- Revoking it in Anikeen ID stops it within 5 minutes (the Console caches Anikeen ID's answer per token for that long).
How tokens are checked
Tokens are JWTs signed by Anikeen ID (RS256). The Console verifies the signature and expiry with Anikeen ID's public key and finds your account by the token's subject. Invalid, expired or revoked tokens and unknown users answer 401 with {"message": "Unauthenticated."}.
The reseller API
The reseller API has its own scopes; user and * do not open it. It accepts personal access tokens and OAuth logins of Anikeen ID, but not the tokens of trusted apps acting for a user (401 client_not_allowed).