Authenticate with a session JWT or workspace-enabled personal access token.
Send a bearer token on every request:
Authorization: Bearer YOUR_TOKENWorkspace-scoped means workspace-bound
Every Embrasure personal access token (PAT) belongs to the workspace selected when the token is created. For endpoints that support workspace inference, such as the OpenLineage receiver, the API can derive workspace_id from the PAT. A session JWT represents the signed-in user across their memberships, so those requests must identify the target workspace explicitly.
| Token | Best for | Notes |
|---|---|---|
| Session JWT | Web and interactive administration | Represents the signed-in user. Required to create PATs. |
Personal access token (dpt_…) | CLI, MCP stdio, API integrations, and CI | Bound to one workspace. Must be enabled by workspace policy. Stored hashed; the raw value is shown once. |
You must be a workspace administrator, and Personal access tokens must be enabled for the workspace.
write.dpt_… value immediately and store it in your deployment's secret manager. Embrasure does not show the raw token again.If creation is disabled, ask a workspace administrator to enable PATs under Admin settings → Sign-in. Disabling PATs later prevents existing PATs from accessing that workspace; revoke tokens that are no longer needed.
POST /v1/auth/tokens requires a signed-in session, admin scope, workspace admin role, and PATs enabled for the workspace.
curl --request POST https://api.embrasure.ai/v1/auth/tokens \
--header "Authorization: Bearer $EMBRASURE_SESSION_JWT" \
--header "Content-Type: application/json" \
--data '{
"workspace_id": "workspace-1",
"name": "airflow lineage",
"expires_in_days": 30,
"scopes": ["read", "write"],
"client_kind": "automation"
}'Available scopes are read, write, and admin. Endpoint scope checks are combined with workspace role checks. A write-scoped token does not make a viewer into an editor.
Pass the raw PAT as a bearer token. Keep it in a credential manager or secret store, inject it at runtime, and never place it in source control, screenshots, agent chat, or build logs.
For lineage ingestion, the token needs write scope and its user must remain an editor or administrator in the same workspace. You may omit workspace_id when using the PAT; if you send it explicitly, it must match the PAT's workspace. Revoke and replace a token before it expires or whenever its secret may have been exposed.