Platform
Authentication
Bearer tokens, OAuth clients, and machine-to-machine auth.
Bearer tokens
Every request must include an Authorization header with a valid Xobriq key.
httpAuthorization: Bearer sk_live_...
OAuth 2.0 (for third-party apps)
If you build a product on top of Xobriq for other tenants, register an OAuth client from Console → Developers. We support the Authorization Code + PKCE flow.
Machine-to-machine (JWT)
For internal services, use short-lived JWTs signed with your key. Xobriq caches key material so verification adds no latency.
Rotate on incident
If a secret leaks, rotate it in the Console immediately. All previous tokens minted with the old key will be denied within 30 seconds.