API Tokens & Intents

API v2 uses token-based authentication with a granular permission system called intents.

Creating a Token

1. Log in to the admin dashboard
2. Navigate to Settings > API Tokens
3. Click Create Token
4. Give the token a name and select the required intents
5. Copy the generated token — it will not be shown again

Token Authentication

All API v2 requests (except /healthy) must include the token in the TOKEN header:

curl -H "TOKEN: your-token" https://your-server.com/api/v2/licenses

Intents Reference

Intent	Permission
PRODUCTS_READ	Read products
PRODUCTS_READ_WRITE	Read and write products
LICENSE_VALIDATE	Validate licenses
LICENSES_READ	Read licenses
LICENSES_READ_WRITE	Read and write licenses
BLACKLISTS_READ	Read blacklist entries
BLACKLISTS_READ_WRITE	Read and write blacklist entries
REQUESTS_READ	Read license request history
CUSTOMERS_READ	Read customers
ALL_READ	Read everything
ALL_READ_WRITE	Full access to everything

Security Notes

• Tokens are stored as BCrypt hashes
• Token values are shown only once at creation
• Revoke tokens from the dashboard at any time
• Use the principle of least privilege — grant only the intents a token needs