Authentication
How to authenticate to the VSQRD HTTP API — Bearer tokens, environments, and a quick smoke check.
Every protected VSQRD API request needs a Bearer token. This page covers how to send it, which environment it belongs to, and how to verify it works.
Send the token
Authorization: Bearer <token>OpenAPI describes this as HTTPBearer. Never put the token in query strings or public repos — prefer an environment variable such as VSQRD_TOKEN injected at runtime.
Base URL
All endpoints are served from https://vsqrd.com.
Verify a token
curl -s -o /dev/null -w '%{http_code}\n' \
-H "Authorization: Bearer $VSQRD_TOKEN" \
https://vsqrd.com/health| Status | Meaning |
|---|---|
200 | Token accepted |
401 | Missing, expired, or wrong-environment token |
403 | Token is valid but lacks access to that resource |
Unauthenticated checks
pnpm check:api probes every route without a token. There, a 401 counts as a pass — it proves the route is alive and enforcing auth. Only 5xx responses are treated as failures. Results land in content/api-specs/status/{env}.json and render on the Status page.