Authentication

Token types

Strix has two types of API tokens:

Personal tokens

Attached to one user
Expire after 90 days (default)
Best for individual scripts and local tools

Service keys

Org-level, not attached to a user
Can stay valid for a long time (no default expiry)
Best for CI/CD pipelines and production integrations
Only org admins can create service keys

Default scopes

Service keys default scopes:

scans:read, scans:write, vulnerabilities:read, vulnerabilities:write,
schedules:read, schedules:write, assets:read, webhooks:read

Personal tokens default scopes:

scans:read, scans:write, vulnerabilities:read, vulnerabilities:write,
schedules:read, schedules:write, assets:read

webhooks:write and tokens:write are admin-only scopes. You must add them when you create a token. You can change the scopes when you create a token.

Available scopes

Each endpoint specifies the scope that it requires. A token can only call the endpoints that match its scopes.

Scope	Grants
`scans:read` / `scans:write`	View / manage pentests, retests, templates
`vulnerabilities:read` / `vulnerabilities:write`	View / update findings, history, fix PRs
`schedules:read` / `schedules:write`	View / manage scheduled scans
`assets:read` / `assets:write`	View / manage domains and repositories
`pr_reviews:read` / `pr_reviews:write`	View / start PR reviews and settings
`connectors:read` / `connectors:write`	View / manage network connectors
`knowledge:read` / `knowledge:write`	View / manage org knowledge, policies, settings
`integrations:read` / `integrations:write`	View / connect / disconnect SCM integrations
`uploads:write`	Request, finalize, and delete file uploads
`chat:read` / `chat:write`	View / start chats and send messages
`analytics:read`	Read dashboard analytics
`test_users:read` / `test_users:write`	View / manage domain test users and inboxes
`organizations:read` / `organizations:write`	View / manage organization settings
`members:read` / `members:write`	View / manage members
`invitations:read` / `invitations:write`	View / manage invitations
`webhooks:read` / `webhooks:write`	View / manage webhooks (write is admin-only)
`audit:read`	Read the audit log
`tokens:write`	Manage API tokens (admin-only)

Using tokens

Include the token in the Authorization header:

curl -X GET "https://app.strix.ai/api/v1/scans" \
  -H "Authorization: Bearer <YOUR_API_TOKEN>"

Best practices

Give each integration only the scopes that it needs (least privilege)
Rotate tokens regularly, especially service keys
If a token is compromised, revoke it immediately. A revoked token stops operation on the next request
Use personal tokens for development and service keys for production

Getting Started

Guides

Authentication

Token types

Personal tokens

Service keys

Default scopes

Available scopes

Using tokens

Best practices

​Token types

​Personal tokens

​Service keys

​Default scopes

​Available scopes

​Using tokens

​Best practices

Token types

Personal tokens

Service keys

Default scopes

Available scopes

Using tokens

Best practices