Tokens and authentication

A token is only needed for a manual that is private or password protected. It is made in the dashboard, shown once, and sent as a bearer. It reads every manual of the brand it belongs to.

When a token is needed

A token that is sent is always checked, on a public manual as well. A wrong one is refused rather than ignored, so a mistyped key is found on the first request and not on the first private manual.

Making a token

WhereDashboard, account menu, API, Tokens

1. Open the brand whose manuals the token should read, then API in the account menu, under your name at the foot of the sidebar.
2. Under Tokens, give it a name that says what will use it, such as the website build, and press Make token.
3. Copy it. It is shown once. Only its hash is stored, so it cannot be shown again; a lost token is replaced by a new one.

• Making and revoking tokens needs the permission Edit workspace settings and domains, which an admin and the owner hold.
• A brand may hold up to 20 live tokens.
• A token starts with sh_. The list shows its first 8 characters, when it was made, and when it was last used, so you can tell which one is still in service before revoking it.

Sending it

In the Authorization header, as Bearer followed by the token. Nothing else: no query parameter, no cookie.

export STYLEHUB_TOKEN=sh_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

curl https://stylehub.cloud/api/v1/manuals/acme.json \
  -H "Authorization: Bearer $STYLEHUB_TOKEN"

What a token may do

• Read every published manual of its brand, the private ones included.
• Read their design tokens and fetch their PDFs.
• Nothing else. The API is read only; there is no write a token could make.

Requests are counted per token rather than per IP address; see Rate limits.

Revoking

WhereDashboard, account menu, API, Tokens, Revoke

A revoked token is refused from the next request that carries it and leaves the list. Revoking cannot be undone; make a new token instead.

Refusals

Both are configuration mistakes. Fail loudly on them rather than retrying; a retry only spends the allowance. The full list of answers, an expired manual's 410 included, is under Errors.