Skip to main content
The Aria Compute API supports three ways to authenticate a request. Which one you use depends on the endpoint: user-scoped endpoints take a session JWT, gateway and model downloads take an API key, and browser-initiated download links can use a short-lived query token.

​
The three credentials

​
Get a session JWT

Sign in with email, phone, or OAuth. The response includes a JWT.
Send that token as Authorization: Bearer eyJhbGciOi... on every user-scoped request. If the account has 2FA enabled, the login response indicates a challenge and you must call POST /api/auth/2fa/verify before receiving a full session.

​
Create an API key

API keys are Bifrost virtual keys prefixed with bfvk-. They are created from the dashboard or via the API and used against the per-site gateway and authenticated download endpoints.
The full key is returned once in the response as key. Store it in a secret manager. Later GET /api/api-keys responses only return prefix, never the full value.
Never embed a bfvk- key in client-side code. Use it from a server or CLI only.

​
Query-token downloads

Some file endpoints support ?token=<jwt> so that a plain <a href> in the browser can download the file without setting headers. This applies to:
  • GET /api/models/{slug}/download?token=...
  • GET /api/billing/invoices/{paymentId}/download?token=...
  • GET /api/billing/receipts/{paymentId}/download?token=...
The token is the same session JWT you use in the Authorization header.

​
Failure modes

Session tokens are short-lived. Re-authenticate by calling POST /api/auth/login when the current token expires.