Authentication & Security

Our API uses token-based authentication to ensure secure access. Every API request must be authenticated by including your Personal Access Token in the HTTP request headers. Below is a detailed guide on how authentication works:

Token Inclusion

All API requests should include your Personal Access Token in the Authorization HTTPS header. The format should be as follows:

Authorization: Bearer <YOUR_PERSONAL_ACCESS_TOKEN>

Replace <YOUR_PERSONAL_ACCESS_TOKEN> with your actual token obtained from the Aurora platform.

How to Generate a Personal Access Token

Follow these steps to create and use your Personal Access Token:

Step 1: User Registration & Login

Start by signing up or logging into the Aurora platform.

Step 2: Navigate to PAT

Go to Settings → Personal Access Tokens within your workspace.

Figure 1: Navigate to Settings → Personal Access Tokens and click the "Create new PAT" button (highlighted in blue)

Step 3: Create a Token

Enter a descriptive token name, select roles to define the token's scope, choose the project access (all accessible projects or specific projects), and set an expiration date.

Figure 2: Fill in the Create New PAT form with the following details:

• Name: Enter a descriptive name for your token (e.g., "Production API Token", "Mobile App Token")
• Expiry date: Select when the token should expire for security purposes
• Workspace Role: Choose the role that defines the token's permissions
• Project Role: Select the project-level access permissions
• Projects: Choose whether to grant access to all projects or specific projects only

Once you click "Create", the system generates your token and displays it in a success modal.

Figure 3: Important: Copy your token immediately and store it securely. You will only see this token once. If you lose it, you'll need to create a new one.

⚠️ Critical Security Notes:

• Copy immediately: The token is only displayed once. Copy it and store it in a secure location.
• Keep it confidential: Never share your token or commit it to version control
• Store securely: Use environment variables or secure vaults (e.g., .env file, password managers, CI/CD secrets)
• Use in API calls: Include the token in your Authorization header for all API requests:

  curl -H "Authorization: Bearer YOUR_COPIED_TOKEN_HERE" https://api.pixxel.space/v0/...

Step 4: Use Your Token in API Requests

Use your copied token in all API requests to the Pixxel Aurora platform:

Example with cURL:

curl -X GET "https://api.pixxel.space/v0/projects" \
  -H "Authorization: Bearer <YOUR_PERSONAL_ACCESS_TOKEN>"

Example with Python:

import requests

headers = {
    "Authorization": "Bearer <YOUR_PERSONAL_ACCESS_TOKEN>"
}

response = requests.get("https://api.pixxel.space/v0/projects", headers=headers)

Example with JavaScript:

const headers = {
    "Authorization": "Bearer <YOUR_PERSONAL_ACCESS_TOKEN>"
};

fetch("https://api.pixxel.space/v0/projects", { headers })
  .then(response => response.json())
  .then(data => console.log(data));

Error Handling for Authentication

• 401 Unauthorized: If your token format is invalid or unrecognized, the API will return a 401 error.
• 403 Forbidden: If your token is missing, expired, revoked, or does not have the necessary permissions, the API will return a 403 error.
• Tips: Ensure that the token is correctly formatted in the header with the Bearer prefix, that it has not expired or been revoked, and that the requested action is within the token's configured scope