Authenticate with a session JWT or workspace-enabled personal access token.
Send a bearer token on every request:
Authorization: Bearer YOUR_TOKEN| Token | Best for | Notes |
|---|---|---|
| Session JWT | Web and interactive administration | Represents the signed-in user. Required to create PATs. |
| Personal access token | CLI, MCP stdio, API integrations, and CI | Must be enabled by workspace policy. Stored hashed; the raw value is shown once. |
POST /v1/auth/tokens requires a signed-in session, admin scope, workspace admin role, and PATs enabled for the workspace.
curl --request POST https://api.embrasure.ai/v1/auth/tokens \
--header "Authorization: Bearer $EMBRASURE_SESSION_JWT" \
--header "Content-Type: application/json" \
--data '{
"workspace_id": "workspace-1",
"name": "airflow lineage",
"expires_in_days": 30,
"scopes": ["read", "write"],
"client_kind": "automation"
}'Available scopes are read, write, and admin. Endpoint scope checks are combined with workspace role checks. A write-scoped token does not make a viewer into an editor.
Store PATs in a credential manager or secret store. Never place them in source control, screenshots, or build logs.