Token Types¶

Overview¶

Each Authentic8 API module uses a dedicated API token. Tokens are scoped to specific wire commands — using the wrong token will result in an AuthenticationError or InsufficientPermissionsError.

Token Reference¶

Config Key	Env Variable	API Module	Class
`ADMIN_TOKEN`	`A8_ADMIN_TOKEN`	Browsing + Org Management	`BrowsingAPI`, `OrgManagementAPI`
`SYNC_TOKEN`	`A8_SYNC_TOKEN`	User Management	`UserManagementAPI`
`FILE_TOKEN`	`A8_FILE_TOKEN`	File Storage	`FileAPI`
`LOG_TOKEN`	`A8_LOG_TOKEN`	Log Extraction	`LogExtractionAPI`
`SCRAPE_TOKEN`	`A8_SCRAPE_TOKEN`	Web Harvesting	`HarvesterAPI`

Wire Commands by Token¶

ADMIN_TOKEN¶

Used by BrowsingAPI and OrgManagementAPI:

create_context     get_context       delete_context
bulk_create_ctx    session_report
org.get            org.create        org.update        org.delete
org.get_children
sso.*              proxy_policy.*

SYNC_TOKEN¶

Used by UserManagementAPI:

listusers     getuser       adduser       modifyuser
deleteuser    suspenduser   unsuspenduser reset_pin

FILE_TOKEN¶

Used by FileAPI:

putfile    getfile    findfiles    modifyfile    deletefile

Upload uses a separate putfile endpoint; download uses getfile. Both are configured in the environment.

LOG_TOKEN¶

Used by LogExtractionAPI:

extractlog

Note: get_log_info does not exist in the ext API. get_log_sequence_info() in the SDK is implemented as a convenience wrapper using an extractlog probe.

SCRAPE_TOKEN¶

Used by HarvesterAPI:

create_harvest_task    find_harvest_task
delete_harvest_task

Token Validation¶

API clients validate token presence on initialization — before any network call:

browsing = BrowsingAPI(config)
# Raises ConfigurationError immediately if ADMIN_TOKEN is missing

This means configuration errors are caught at startup, not mid-execution.

Security Guidance¶

Token storage

Never commit tokens to source control
Store tokens in .env files (gitignored) for local development
Use environment variables or a secrets manager in production
Rotate tokens regularly

Least privilege

Only configure the tokens your application needs. If your app only extracts logs, you only need LOG_TOKEN — there's no reason to configure ADMIN_TOKEN in that environment.