The Aria Compute API accepts three credential types. This page explains where each one comes from, how to send it, and which endpoints require which.
Credential summary
Session JWT
Send the returned token as Authorization: Bearer on every user-scoped request. Session JWTs are short-lived; call login again to refresh.
If 2FA is enabled, the login response indicates a challenge and you must call POST /api/auth/2fa/verify to receive the final session.
API key (bfvk-)
Create keys with a session JWT:
The response includes the full key exactly once as key. Store it in a secret manager and send it as Authorization: Bearer bfvk-... on model downloads and gateway calls.
Never expose a bfvk- key in client-side JavaScript, mobile apps, or public repositories. Anyone who reads the key can spend your wallet.
Query token
Some file endpoints accept ?token=<jwt> so an anchor tag in the browser can trigger the download without setting headers. The token is the same session JWT.
Supported endpoints:
GET /api/models/{slug}/download?token=...GET /api/billing/invoices/{paymentId}/download?token=...GET /api/billing/receipts/{paymentId}/download?token=...
Token expiration and refresh
Session JWTs expire on their own; call POST /api/auth/login (or the 2FA verify endpoint) again for a fresh token. API keys stay valid until you DELETE them.
Failure modes
