/v1/auth4 endpoints

Authentication API

Manage API keys, scopes, and token lifecycle. API keys use SHA-256 hashing with show-once security model (like Stripe).

API key lifecycleSHA-256 hashed storageScope-based permissionsKey rotation with grace periodShow-once security

Endpoints

Required Scope:write:all

The full API key token is shown ONLY on creation. Only the SHA-256 hash is stored. Save the key immediately.

Request Body

Field	Type	Required	Description
name	string	Required	Key name for identification
scopes	string[]	Optional	Permission scopes (default: read:all)
expiresIn	string	Optional	30d, 90d, 1y, never (default: 90d)

Response Example

{
  "success": true,
  "data": {
    "key": {
      "id": "key_Cd7e8f",
      "name": "Production Backend",
      "token": "ax_pk_aBcDeFgHiJkLmNoPqRsTuVwXyZ",
      "prefix": "ax_pk_aBcD",
      "scopes": ["read:products", "write:orders", "read:customers"],
      "expiresAt": "2026-09-05T10:00:00Z",
      "createdAt": "2026-06-05T10:00:00Z"
    }
  }
}

All Modules API Reference

Authentication API

Endpoints

Request Body

Response Example

Axlaas Support