Authentication

Token types

Strix supports two types of API tokens:

Personal tokens

Tied to a specific user
Default to 90-day expiry
Best for individual scripts and local tooling

Service keys

Org-level, not tied to a user
Can be long-lived (no default expiry)
Best for CI/CD pipelines and production integrations
Only org admins can create service keys

Default scopes

Service keys default scopes:

scans:read, scans:write, vulnerabilities:read, vulnerabilities:write,
schedules:read, schedules:write, assets:read, webhooks:read

Personal tokens default scopes:

scans:read, scans:write, vulnerabilities:read, vulnerabilities:write,
schedules:read, schedules:write, assets:read

webhooks:write and tokens:write are admin-only scopes and must be explicitly added when creating a token. You can customize scopes when creating a token.

Available scopes

Every endpoint declares the scope it requires. A token can only call endpoints whose scope it holds.

Scope	Grants
`scans:read` / `scans:write`	View / manage pentests, retests, templates
`vulnerabilities:read` / `vulnerabilities:write`	View / update findings, history, fix PRs
`schedules:read` / `schedules:write`	View / manage scheduled scans
`assets:read` / `assets:write`	View / manage domains and repositories
`pr_reviews:read` / `pr_reviews:write`	View / start PR reviews and settings
`connectors:read` / `connectors:write`	View / manage network connectors
`knowledge:read` / `knowledge:write`	View / manage org knowledge, policies, settings
`integrations:read` / `integrations:write`	View / connect / disconnect SCM integrations
`uploads:write`	Request, finalize, and delete file uploads
`chat:read` / `chat:write`	View / start chats and send messages
`analytics:read`	Read dashboard analytics
`test_users:read` / `test_users:write`	View / manage domain test users and inboxes
`organizations:read` / `organizations:write`	View / manage organization settings
`members:read` / `members:write`	View / manage members
`invitations:read` / `invitations:write`	View / manage invitations
`webhooks:read` / `webhooks:write`	View / manage webhooks (write is admin-only)
`audit:read`	Read the audit log
`tokens:write`	Manage API tokens (admin-only)

Using tokens

Include the token in the Authorization header:

curl -X GET "https://app.strix.ai/api/v1/scans" \
  -H "Authorization: Bearer <YOUR_API_TOKEN>"

Best practices

Apply least-privilege scopes per integration
Rotate tokens regularly, especially service keys
Revoke tokens immediately if compromised — revoked tokens stop working on the next request
Use personal tokens for development and service keys for production

Getting Started

Guides

Authentication

Token types

Personal tokens

Service keys

Default scopes

Available scopes

Using tokens

Best practices

​Token types

​Personal tokens

​Service keys

​Default scopes

​Available scopes

​Using tokens

​Best practices

Token types

Personal tokens

Service keys

Default scopes

Available scopes

Using tokens

Best practices