Authentication

The Corelix API uses Bearer token authentication via Laravel Sanctum. Every request must include a valid API token.

Creating an API Token

1. Log in to your Corelix dashboard.
2. Go to Settings > Keys & Tokens > API Tokens.
3. Click Create Token.
4. Enter a descriptive name (e.g., "CI/CD Pipeline", "Monitoring Script").
5. Select the required scopes.
6. Click Create.
7. Copy the token immediately — it won't be shown again.

Using Tokens

Include the token in the Authorization header of every request:

curl -H "Authorization: Bearer YOUR_API_TOKEN" \
     -H "Accept: application/json" \
     https://app.corelix.io/api/v1/servers

Always include Accept: application/json to ensure JSON responses.

Token Scopes

When creating a token, select the minimum scopes required:

Scope	Allowed Actions
read	GET requests — list and view resources
write	POST, PATCH, PUT, DELETE — create, update, delete resources
deploy	POST to deployment endpoints — trigger builds and deployments

Scope Examples

Use Case	Required Scopes
Monitoring dashboard	read
CI/CD deployment pipeline	read, deploy
Automation script (full)	read, write, deploy
Backup management	read, write

Team-Scoped Access

API tokens are tied to the team that was active when the token was created. All API requests return only resources belonging to that team.

To access resources across multiple teams, create separate tokens for each team.

Token Security

• Store tokens securely — Use environment variables or secret managers. Never commit tokens to source control.
• Rotate regularly — Delete old tokens and create new ones periodically.
• Minimum privileges — Only grant the scopes your integration needs.
• Monitor usage — Review your active tokens in Settings and delete any you no longer use.

Error Responses

Missing Token

# Request without Authorization header
curl https://app.corelix.io/api/v1/servers

{
  "message": "Unauthenticated."
}

Status: 401 Unauthorized

Invalid Token

curl -H "Authorization: Bearer invalid-token" \
     https://app.corelix.io/api/v1/servers

{
  "message": "Unauthenticated."
}

Status: 401 Unauthorized

Insufficient Scope

# Token with only 'read' scope attempting a write operation
curl -X POST -H "Authorization: Bearer READ_ONLY_TOKEN" \
     -H "Content-Type: application/json" \
     -d '{"name":"New Project"}' \
     https://app.corelix.io/api/v1/projects

{
  "message": "Invalid ability provided."
}

Status: 403 Forbidden