Authentication

How to authenticate to the VSQRD HTTP API — Bearer tokens, environments, and a quick smoke check.

Every protected VSQRD API request needs a Bearer token. This page covers how to send it, which environment it belongs to, and how to verify it works.

Send the token

Authorization: Bearer <token>

OpenAPI describes this as HTTPBearer. Never put the token in query strings or public repos — prefer an environment variable such as VSQRD_TOKEN injected at runtime.

Base URL

All endpoints are served from https://vsqrd.com.

Verify a token

curl -s -o /dev/null -w '%{http_code}\n' \
  -H "Authorization: Bearer $VSQRD_TOKEN" \
  https://vsqrd.com/health
StatusMeaning
200Token accepted
401Missing, expired, or wrong-environment token
403Token is valid but lacks access to that resource

Unauthenticated checks

pnpm check:api probes every route without a token. There, a 401 counts as a pass — it proves the route is alive and enforcing auth. Only 5xx responses are treated as failures. Results land in content/api-specs/status/{env}.json and render on the Status page.