Skip to main content
The PIN API uses a dual authentication model. Most endpoints require a user-created Bearer API key. Internal agent callback endpoints use a separate HMAC token scheme. Bearer API key Pass your key in the Authorization header on every request:
You can bootstrap the first key using the ADMIN_API_KEY environment variable on the PIN server, or create user-scoped keys via the /v1/apikeys endpoints. API keys are scoped to the user who created them. Public routes The following routes do not require authentication:
  • GET /health
  • GET /version
  • POST /v1/auth/login
  • POST /v1/auth/register
Node-agent HMAC token Routes under /v1/agent/* use a node-agent HMAC token in a separate authentication scheme designed for internal agent callbacks. These tokens are not user-managed API keys. Example request
If the key is missing or invalid, PIN returns 401 Unauthorized with an error envelope: