Skip to main content
The Dataerai API supports two authentication methods.

​
OAuth2 access token (programmatic access)

For scripts, the CLI, the SDKs, and other integrations, authenticate with an OAuth2 access token sent as a bearer token:
You obtain a token by signing in through the browser or device flow. The CLI and SDKs run this flow for you, store the token, and refresh it automatically — so in practice you sign in once and let the client handle the rest. There is no separate “create an API key” page in the web app: a token is the result of completing the sign-in flow. The flow is PKCE-protected, and tokens carry read and write scopes by default (openid is also available to share your email). Access tokens are short-lived and a refresh token is exchanged for a fresh one in the background, so long-running clients keep working without you signing in again.

​
Use a token in a request

Once a client has signed in, send the access token as a bearer token on any REST call:

​
Sign in without a browser

On a headless host — a server, an HPC node, or a CI runner — use the device flow: a client starts it, prints a short verification URL and code, and you approve the request from any device with a browser. The CLI runs this for you with dataerai auth login --device. When you’re signed in to the Dataerai web app, requests are authenticated with a session cookie. This is what the browser app uses; programmatic callers should use an access token instead.

​
Trying endpoints here

The interactive playground on each endpoint page sends real requests to the server you configure. Provide a valid credential to call authenticated endpoints, and never paste a production token into a shared or public environment.

​
Next steps

Authenticate the CLI

Get a token with the browser or device flow.

API reference

Base URL, formats, and conventions.