🚧 Expanding soon — full Authentication documentation is in progress.
Operator token
Every Pro account gets an operator token. This token authenticates all API requests and associates them with your operator account.
Token format: bm_live_••••••••••••••••••••••••••••••
Getting your token
- Sign up at bossmode.ing/signup
- Go to Settings → API Token
- Copy your token
Using your token
Pass the token in the x-bossmode-token header on every request:
Never pass the token as a query parameter — it will appear in server logs.
Storing your token safely
Never commit your token to a repository. Never log it. Never embed it in client-side code.
Token rotation
Rotation immediately invalidates the old token and returns a new one. Update your environment variables before the old token expires (60 second grace period).
Service-to-service calls
For internal service-to-service calls (e.g., from your own server to BossMode), use the BOSSMODE_SERVICE_KEY environment variable. This key bypasses rate limits and is not tied to a single operator account.
Contact support for service key provisioning.
Token scopes
Future versions will support scoped tokens with fine-grained permissions. For now, all tokens have full operator access.
Errors
