Authentication
Maintained by: Aether365 Team Audience: Developers Scope: API key creation and authenticating API requests
The Aether365 API at api.aether365.io uses API keys. Every request must include an API key in the Authorization header.
Obtaining an API Key
API keys are created in the Aether365 dashboard under Settings > API Keys. API access requires a plan that includes it.
The full key value (format: ak_live_...) is shown once at creation time - store it in a secrets manager immediately. See API Keys for programmatic key management.
Using the Key
Include the key in the Authorization header of every request:
bash
curl https://api.aether365.io/tenants/me/scans \
-H "Authorization: Bearer ak_live_..."Key Scope and Expiry
API keys do not expire. Each key is bound to the tenant that created it - the API derives your tenant from the key, so you never pass tenant IDs for authentication. Revoke a key at any time from the dashboard or with DELETE /tenants/me/api-keys/{keyId}.
API Keys vs JWT Session Tokens
The Aether365 web application signs users in with Microsoft and uses short-lived JWT session tokens against the region-specific endpoints (eu-api.aether365.io / us-api.aether365.io). Those tokens are not accepted on api.aether365.io, and API keys are not accepted on the regional endpoints.
For automation and integrations, always use an API key against https://api.aether365.io - requests are routed to your tenant's home region automatically.
Authentication Errors
| Code | HTTP | Meaning |
|---|---|---|
AUTH_MISSING_TOKEN | 401 | No Authorization: Bearer ak_live_... header present |
AUTH_INVALID_METHOD | 401 | A JWT was sent to api.aether365.io, or an API key to a regional endpoint |
AUTH_INVALID_TOKEN | 401 | The API key is invalid or has been revoked |
AUTH_INSUFFICIENT_SCOPE | 403 | The tenant's plan does not include API access |