Authentication

You authenticate with the Skovik API by providing one of your API tokens in the request. Tokens are managed from your account and multiple API tokens may be active at once (useful for key rotation, for example). API tokens does not expire, but an admin may revoke them via the Skovik UI.

Use the Bearer scheme to authenticate.

All endpoints except the root require authentication.

As an API-user you should always use up-to-date encryption libraries. Use the cipher negotiated by our servers and make sure our server certificates are verified and checked against revocation lists.

🗝

Keep API Tokens Secret

API tokens carry many privileges and should be kept secret. Treat them with the same care as a master-password.

📘

Ciphers & Protocols May Change Swiftly

In the last few years there has also been a steady stream of wittily named vulnerabilities in internet security protocols: POODLE, BEAST, Heartbleed, Shellshock, CRIME etc.

Such vulnerabilities may affect the server, the client or both. Many of them has required swift action to keep systems secure. This is one area where we cannot always provide backwards-compatibility.

We may need to drop support for certain ciphers, upgrade protocol requirements or make other security adjustments — with little or no notice. Proper error handling with exponential backoff and a quick process to roll out client upgrades will make it easier for you to deal with such changes.

API Scopes

Each API key has one or more scopes associated with it. Scopes define which API resources the key can access, and gives you stricter control over what each API key can be used for.

We strongly encourage setting only the required scopes for API keys, limiting the blast radius.

API key scopes are set up when creating an API key, and can be modified at any time.

For each scope, there are three levels of permission: none, read, and write.

• None means the key cannot access that resource.
• Read means the key can read the resource, but not write to it.
• Write means the key can both read and write to the resource.

You can see which scope is required for each endpoint in its docs, found under Resources.