Skip to main content
Create a token under Settings → API tokens. The raw dais_… value is shown once; only its SHA-256 hash is stored. Send it on every request as the x-access-token header:
Every response is scoped to the organization that owns the token — there is no cross-organization access, and unknown or foreign resource IDs return the same 404. Tokens can carry a read scope (safe for dashboards and exports) or full access. Revoke any token instantly from the same settings page.
The same tokens authenticate the hosted MCP server and the sw CLI. The interactive OpenAPI explorer for the entire application (beyond /v1) is served by the API itself at /docs.