Authentication

Credentials, headers, and authorization for API requests.

StormNodes developer reference

Bearer credentials

Authenticated API requests accept a Bearer token formed by joining your API client public key and private key with a dot. Each key has an fp_ prefix followed by 64 hexadecimal characters. Keep the private key on your application server.

Authorization: Bearer <public_key>.<private_key>
Accept: application/json
Content-Type: application/json

Request example

This read-only request lists servers available to the credential owner. Replace the placeholder with your own credential; do not embed credentials in browser code or public repositories.

curl https://stormnodes.xyz/api/user/servers \
  -H "Authorization: Bearer <public_key>.<private_key>" \
  -H "Accept: application/json"

Server access

API credentials act as their owning user. Server endpoints check ownership or the relevant subuser permission. A valid credential does not grant access to another customer’s resources.

Browser sessions use the remember_token cookie. Browser mutations are also checked against the request origin. External applications should use API credentials rather than copying session cookies.