Authentication

Authenticate to the AYAsec API with bearer tokens, understand token scope, and make secure workspace API requests.

AYAsec issues API tokens from Settings → API Access . There's no separate OAuth flow for API clients - you generate a token from your account, scope it, and use it as a bearer credential.

Token types

• Personal tokens - tied to your user account and inherit your role's permissions
• Service keys - not tied to any one person, intended for automation that should keep working after someone leaves. Available on Pro and above

Either type can be bound to one or more specific workspaces at creation, so a key only ever sees that workspace's data - useful if you're managing several clients' domains and want a key scoped to just one of them.

Scopes

Every token is created with an explicit set of scopes - it can only do what it's scoped for, and can optionally be bound to specific workspaces so it only ever sees that workspace's data. Available scopes cover scans (read/run), targets (read/write), reports (read), webhooks (read/write), and token management - see the Endpoints reference for exactly which scope each request needs.

Using a token

Send the token in the Authorization header:

What's covered today

Token-based programmatic access is actively expanding. If you're building an integration, generate a token, check which of your scopes are already wired up against the endpoints you need, and reach out if something you expect isn't there yet - the scope list above reflects where the API is headed, not necessarily every endpoint that accepts it today.