Skip to content
Spawnbase Docs

Authentication

Every API call takes your team’s token in the Authorization header. Raw key, no Bearer prefix (the API also accepts Bearer <key>):

Terminal window
curl https://api.spawnbase.gg/api/v1/file \
  -H "Authorization: YOUR_TOKEN"
  • Tokens are created in the dashboard (Tokens page) or during a migration. The plaintext is shown once; only a hash is stored.
  • Token types: Media, Logs, Full. Scopes underneath: files:read, files:write, files:delete, logs:read, logs:write, logs:import. A token without the needed scope gets 403 forbidden.
  • Missing or bad key: 401 unauthorized. Revoked and expired keys behave the same — the API never says which.
  • Rotate by creating a new token, updating your config, then revoking the old one. Revocation is immediate.
  • Never ship a token to a game client. For client uploads use presigned URLs.