API Authentication
How to authenticate with the AgentDocs API using JWT tokens or API tokens.
Overview
AgentDocs supports two authentication methods for its REST API. Which one you use depends on your use case:
JWT (JSON Web Tokens)
Used by the web UI. Short-lived access tokens obtained by logging in with email and password. Automatically refreshed by the browser.
API Token
Long-lived token for programmatic access. No expiry. Perfect for agents, scripts, CI/CD pipelines, and integrations.
JWT Authentication
JWT authentication is a two-step process: first you log in to get an access token, then you include that token in subsequent requests.
Step 1: Log In
Send your credentials to the login endpoint to receive a JWT access token:
curl -X POST https://agentdocs.eu/api/auth/login \
-H "Content-Type: application/json" \
-d '{
"email": "alice@example.com",
"password": "your_password"
}'
# Response:
{
"token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
"user": {
"id": "usr_abc123",
"name": "Alice",
"email": "alice@example.com"
}
}Step 2: Use the Token
Include the JWT token in the Authorization header of every API request:
curl https://agentdocs.eu/api/workspaces \ -H "Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."
ℹ️ Note: JWT tokens are short-lived and will expire. The web UI handles refresh automatically. For programmatic access, we recommend using API tokens instead — they never expire and are simpler to manage.
API Token Authentication
API tokens are the recommended method for agents, scripts, and any non-interactive use. They are long-lived, don't expire, and use a simple header format.
Getting Your API Token
Your API token is displayed on the dashboard after you log in. You can also find it in your account settings. To retrieve it:
- Log in to AgentDocs at
https://agentdocs.eu/login - Navigate to your Dashboard
- Your API token is shown in the top section of the dashboard page
- Click the copy button to copy it to your clipboard
Using the API Token
Include your token in the Authorization header using the Token scheme:
# API Token authentication
curl https://agentdocs.eu/api/workspaces \
-H "Authorization: Token your_api_token_here"
# Create a page
curl -X POST https://agentdocs.eu/api/spaces/SPACE_ID/pages \
-H "Authorization: Token your_api_token_here" \
-H "Content-Type: application/json" \
-d '{"title": "New Page", "content": "# Hello"}'
# Update a page
curl -X PUT https://agentdocs.eu/api/pages/PAGE_ID \
-H "Authorization: Token your_api_token_here" \
-H "Content-Type: application/json" \
-d '{"content": "# Updated content"}'Token Format Comparison
| Method | Header Format | Lifetime |
|---|---|---|
| JWT | Authorization: Bearer eyJhbG... | Short-lived (hours) |
| API Token | Authorization: Token abc123... | Long-lived (no expiry) |
Share Token Access (No Auth)
For read-only access to individual pages, share links provide a third option that requires no authentication at all. The share token embedded in the URL serves as the credential:
# No Authorization header needed! curl https://agentdocs.eu/api/shared/abc123def456/raw # Returns plain Markdown with YAML frontmatter
This is the simplest way to give an AI agent access to documentation. See the Working with Agents guide for detailed examples.
Error Responses
When authentication fails, the API returns standard HTTP error codes:
| Status | Meaning | Common Cause |
|---|---|---|
| 401 Unauthorized | Missing or invalid credentials | No token provided, token is malformed, or JWT is expired |
| 403 Forbidden | Insufficient permissions | Valid token but user lacks the required role for this action |
| 404 Not Found | Resource not found | Invalid share token, or resource doesn't exist / isn't accessible |
# Example error response (401)
{
"error": "Authentication required"
}
# Example error response (403)
{
"error": "Insufficient permissions"
}Security Best Practices
Never commit API tokens to version control. Use environment variables or secret managers.
Use share links (read-only) when agents only need to read documentation. Avoid giving write access unnecessarily.
API tokens inherit the permissions of the user account. Consider creating a dedicated service account for agents.
Rotate your API token if you suspect it has been compromised. You can regenerate it from the dashboard.
Revoke share links promptly when access is no longer needed.
Important: Treat your API token like a password. Anyone with your token can access and modify all resources your account has permission to.
API Rate Limits
API calls are metered per workspace per month. The limits depend on your plan:
10,000
API calls / month
1,000,000
API calls / month
Usage is tracked per workspace. You can monitor your current usage in the workspace settings under the Billing tab.