Bearer Authentication – Overview

Bearer Authentication secures DocuWriter.ai’s REST API by requiring clients to present a valid token with each request. Tokens follow the standard Authorization: Bearer scheme. This approach enables stateless, scalable authentication without sessions or cookies.

🔐 What Is Bearer Authentication?

  • A token-based scheme where clients include a secret token in the HTTP Authorization header.
  • The server verifies the token on every request, granting access if valid.
  • Ideal for APIs—no need to manage server-side session state.

🏗️ How Tokens Are Issued

Manage account -> API Tokens

🧭 Using Bearer Tokens

Include your token in every API call:

curl https://app.docuwriter.ai/api/user \
  -H "Authorization: Bearer your_personal_access_token"
  • If the token is missing or invalid, the API returns 401 Unauthorized.
  • If the token is valid but the user lacks permissions, the API returns 403 Forbidden.

📦 Protected Endpoints

HTTP Method Endpoint Description Auth Required
POST /api/user Retrieve authenticated user’s profile ✅ Yes
POST /api/my-generations List user’s documentation generations ✅ Yes
GET /api/spaces List user’s Spaces ✅ Yes
POST /api/spaces/{space}/search Search within a Space ✅ Yes
GET /api/spaces/{space}/documents/{item} Show a document in a Space ✅ Yes
POST /api/spaces/{space}/documents Create a new document in a Space ✅ Yes
PUT /api/spaces/{space}/documents/{item} Update a document in a Space ✅ Yes
DELETE /api/spaces/{space}/documents/{item} Delete a document in a Space ✅ Yes
POST /api/generate-code-documentation Generate code documentation for a file ✅ Yes
POST /api/generate-multi-file-documentation Generate docs for multiple files ✅ Yes
… and many more generation, management, webhook, and feedback endpoints … ✅ Yes

(All /api/ routes require a valid Bearer token.)*

📊 Status Codes

Status Code Meaning
200 OK Request succeeded
201 Created Resource created (e.g., documentation generated)
401 Unauthorized Missing or invalid Bearer token
403 Forbidden Valid token, but insufficient permissions
404 Not Found Resource not found
422 Unprocessable Entity Validation errors on request payload