> ## Documentation Index
> Fetch the complete documentation index at: https://docs.app.strix.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Token types, scopes, and best practices

export const ScarfPixel = () => <img referrerPolicy="no-referrer-when-downgrade" src="https://static.scarf.sh/a.png?x-pxid=831669b6-b4bd-42cb-8832-2122c03e1d5f" alt="" width="1" height="1" style={{
  position: "absolute",
  width: 0,
  height: 0,
  opacity: 0,
  pointerEvents: "none"
}} />;

<ScarfPixel />

## Token types

Strix supports two types of API tokens:

### Personal tokens

* Tied to a specific user
* Default to 90-day expiry
* Best for individual scripts and local tooling

### Service keys

* Org-level, not tied to a user
* Can be long-lived (no default expiry)
* Best for CI/CD pipelines and production integrations
* **Only org admins can create service keys**

## Default scopes

**Service keys** default scopes:

```
scans:read, scans:write, vulnerabilities:read, vulnerabilities:write,
schedules:read, schedules:write, assets:read, webhooks:read
```

**Personal tokens** default scopes:

```
scans:read, scans:write, vulnerabilities:read, vulnerabilities:write,
schedules:read, schedules:write, assets:read
```

`webhooks:write` and `tokens:write` are admin-only scopes and must be explicitly added when creating a token.

You can customize scopes when creating a token.

## Available scopes

Every endpoint declares the scope it requires. A token can only call endpoints whose scope it holds.

| Scope                                            | Grants                                          |
| ------------------------------------------------ | ----------------------------------------------- |
| `scans:read` / `scans:write`                     | View / manage pentests, retests, templates      |
| `vulnerabilities:read` / `vulnerabilities:write` | View / update findings, history, fix PRs        |
| `schedules:read` / `schedules:write`             | View / manage scheduled scans                   |
| `assets:read` / `assets:write`                   | View / manage domains and repositories          |
| `pr_reviews:read` / `pr_reviews:write`           | View / start PR reviews and settings            |
| `connectors:read` / `connectors:write`           | View / manage network connectors                |
| `knowledge:read` / `knowledge:write`             | View / manage org knowledge, policies, settings |
| `integrations:read` / `integrations:write`       | View / connect / disconnect SCM integrations    |
| `uploads:write`                                  | Request, finalize, and delete file uploads      |
| `chat:read` / `chat:write`                       | View / start chats and send messages            |
| `analytics:read`                                 | Read dashboard analytics                        |
| `test_users:read` / `test_users:write`           | View / manage domain test users and inboxes     |
| `organizations:read` / `organizations:write`     | View / manage organization settings             |
| `members:read` / `members:write`                 | View / manage members                           |
| `invitations:read` / `invitations:write`         | View / manage invitations                       |
| `webhooks:read` / `webhooks:write`               | View / manage webhooks (write is admin-only)    |
| `audit:read`                                     | Read the audit log                              |
| `tokens:write`                                   | Manage API tokens (admin-only)                  |

## Using tokens

Include the token in the `Authorization` header:

```bash theme={null}
curl -X GET "https://app.strix.ai/api/v1/scans" \
  -H "Authorization: Bearer <YOUR_API_TOKEN>"
```

## Best practices

* Apply **least-privilege scopes** per integration
* **Rotate tokens regularly**, especially service keys
* **Revoke tokens immediately** if compromised — revoked tokens stop working on the next request
* Use **personal tokens** for development and **service keys** for production