Authentication
The Gazebo REST API uses bearer tokens. Gazebo issues two different token types for two different jobs:
| Token | Used for | Accepted by |
|---|---|---|
| Account API token | Trusted automation across your Gazebo account | Supported /api/v1 account administration endpoints |
| Agent token | Scoped credential access for one agent | /api/agents/* and /api/mcp |
Tokens are not interchangeable. An agent token cannot access /api/v1, and an account API token cannot retrieve credentials through the agent REST API or the MCP get_credential tool.
Authorization header
Include the appropriate token in every request:
Authorization: Bearer YOUR_TOKEN
Account API tokens
Generate an account API token in Settings. Generating a replacement revokes the previous account token.
Account API tokens have broad authority. Store them as secrets and use them only in trusted server-side automation, scripts, and CI systems.
curl https://app.gazebohq.com/api/v1/agents \
-H "Authorization: Bearer YOUR_ACCOUNT_API_TOKEN"
The reference documents the /api/v1 endpoints Gazebo supports for external use. Account API tokens are rejected on other /api/v1 routes, including notification preferences, LTD claims, login routes, and account-token generation.
Verify a token and identify its account with:
curl https://app.gazebohq.com/api/v1/me \
-H "Authorization: Bearer YOUR_ACCOUNT_API_TOKEN"
Account API tokens cannot rotate themselves. Generate or replace the token from the signed-in Gazebo dashboard.
Agent tokens
An agent token belongs to one agent and is constrained by that agent's service and HTTP-method access policy. The token is shown once when the agent is created.
curl "https://app.gazebohq.com/api/agents/me/credentials/stripe?method=GET" \
-H "Authorization: Bearer YOUR_AGENT_TOKEN"
Revoking the agent immediately invalidates its token without rotating the underlying service credentials.
See Bearer tokens for the agent-token lifecycle and Agent credential access for the REST contract.
Browser sessions
The Gazebo dashboard also calls /api/v1 using its signed-in browser session. Browser sessions are not an API authentication method for external integrations.
Agent Consent Flow
Agent Consent Flow has its own authorization, token exchange, introspection, and revocation flow. Its tokens are not account API tokens or agent tokens. See the dedicated Agent Consent Flow integration guide.