Authenticate callers

Every /api/v1 route requires a credential, and AXL is deliberately flexible about what kind - because a person signing in through a browser, a backend service, and a partner integration have genuinely different needs.

AXL accepts its own signed JWTs, configured external identity-provider tokens, and API keys. Pick the flow that matches the client:

• Interactive web users normally sign in through OIDC federation.
• Service integrations use OAuth client credentials or managed API keys.
• Development clients can use a locally issued token in a controlled environment.

Clients send the credential as a Bearer token. Never place user tokens in documentation builds or agent configuration. Use the interactive HTTP API to supply a token only inside the local request playground.

See Authentication reference.

Next

• Reach services as the user - once callers are identified, what they may reach.
• Configure the shield - protection that authentication cannot provide.
• Authentication reference - issuers, audiences, and key settings.