Authentication

Bearer tokens

Core REST API calls require a bearer JWT obtained after Google sign-in in the portal. Send it on every request:

Authorization: Bearer <token>

Customer routes use the authenticated account as the ownership boundary. You can only see and change your own projects, containers, databases, and billing.

When a token is missing, expired, or invalid, the API replies 401 with the standard { "code", "message" } error envelope (code is UNAUTHORIZED). See error codes for the full list.

Machine (CI) tokens

Deploy and registry-push flows do not use your Google session token. A GitHub Actions workflow exchanges its OIDC identity for a short-lived registry token (to push the image) or a single-use deploy token scoped to one app (to roll it out). The portal generates the full pre-filled workflow for you, so you only copy it in and push. See Deploy from GitHub via OIDC and the Deployments API.

AI API keys

The AI inference endpoint authenticates with its own sk-alwd- key, minted on the AI page in the portal, not with your portal bearer token:

Authorization: Bearer sk-alwd-...

A key is shown once at creation and stored only as a hash, so it cannot be retrieved later. Revoking it takes effect immediately. See API keys and authentication for the full lifecycle.