Authentication & API keys
Bearer token authentication
Every request to the public REST API and the MCP server is authenticated with a bearer token:
Authorization: Bearer <TOKEN>
Content-Type: application/json (required on POST/PATCH/PUT)Generating a token
Generate the token
Generate a token from Admin → Generate Token inside your AlignAI environment.
Name it and set an expiration
Give it a name and an expiration.
Copy the value
Copy the value immediately — it is not shown again.
Never commit a token to source control. Store the token in an environment variable or your platform’s secret manager.
Tokens are bound to a single environment
A token issued in one environment (e.g., your QA sandbox) will not work
against another (e.g., production). Calling the wrong host with a
valid-looking token returns 401 Unauthorized — "Token does not exist".
If you see this error, double-check that the token and the base URL in your request both belong to the same environment. See Environments & sandbox for the current list of base URLs.
Key lifecycle: issuance, rotation, revocation
- Generate a new token from Admin → Generate Token whenever you need one — for a new integration, a new environment, or a scheduled rotation.
- When you generate a new token to replace an old one, discard the old token immediately. AlignAI does not automatically revoke a previous token when a new one is issued for the same purpose — treat that as a manual step in your rotation process.
- Use a separate token per environment (production vs. non-production) so that a QA credential can never touch production data by accident.
- Every token has full read and write access to use cases and solutions in its environment — isolate any read-only or analytics use case in its own service account and token.
In-product Swagger / OpenAPI reference
Every AlignAI environment publishes a live, authenticated Swagger UI at:
https://<your-environment-host>/api/swaggerThis mirrors the REST reference in this guide and is the fastest way to try a call by hand or generate a client from the OpenAPI spec. It requires the same bearer token as the REST API itself.