Authentication

You authenticate with the Skovik API by providing one of your API tokens in the request.
Tokens are managed from your account and multiple API tokens may be active at once (useful for key rotation, for example).
API tokens does not expire, but an admin may revoke them via the Skovik UI.

Use the Bearer scheme to authenticate.

All endpoints except the root require authentication.

As an API-user you should always use up-to-date encryption libraries.
Use the cipher negotiated by our servers and make sure our server certificates are verified and checked against revocation lists.

🗝

Keep API Tokens Secret

API tokens carry many privileges and should be kept secret.
Treat them with the same care as a master-password.

📘

Ciphers & Protocols May Change Swiftly

In the last few years there has also been a steady stream of wittily named vulnerabilities in
internet security protocols: POODLE, BEAST, Heartbleed, Shellshock, CRIME etc.

Such vulnerabilities may affect the server, the client or both. Many of them has required swift action to keep systems secure.
This is one area where we cannot always provide backwards-compatibility.

We may need to drop support for certain ciphers, upgrade protocol requirements or make other security adjustments — with little or no notice.
Proper error handling with exponential backoff and a quick process to roll out client upgrades will make it easier for you to deal with such changes.