Skip to main content

Authentication

To authenticate with the API you need a token. There are two kinds, and they are not interchangeable:

  • Bot — created from user settings in the client.
  • User — a session token, obtained from the client or by authenticating through the API.

Present it as a header on every authenticated route:

TypeHeader
BotX-Bot-Token
UserX-Session-Token

A session token belongs to one session and dies with it: revoking the session from settings invalidates the token immediately. That is deliberate — it is what makes "log out everywhere" mean something.

Treat both kinds as passwords. A bot token grants everything the bot can do, and it does not expire on its own.