Authentication

Every Layer REST API request must be authenticated with a bearer token in the Authorization header:

curl https://api.app.layer.ai/api/v1/workspaces \
  -H "Authorization: Bearer $LAYER_TOKEN"

The API base URL is https://api.app.layer.ai/api, and every endpoint is versioned under /v1 — so full paths look like https://api.app.layer.ai/api/v1/workspaces/{workspace_id}/....

Personal Access Tokens

A Personal Access Token (PAT) is the recommended way to authenticate a server-side integration. Tokens are prefixed with pat_.

1. Log in to app.layer.ai.
2. Go to Settings → Personal Access Tokens.
3. Click Create Token, give it a name (and an optional expiry), and copy the value.

Caution

The token value is shown only once, at creation time — Layer stores a hash, not the token. Store it in a secret manager; if you lose it, create a new one.

A PAT is created and managed only in the app UI — there is no REST endpoint to mint, list, or revoke tokens.

Permissions

A PAT inherits all of the permissions of the user who created it — there are no per-token scopes. Treat a PAT as equivalent to that user’s access, and provision integration users with only the workspace access they need. Requests for actions the user isn’t allowed to perform return 403 FORBIDDEN.

Expiry

If you set an expiry when creating the token, requests made after that time fail with 401 UNAUTHENTICATED. Rotate tokens before they expire.

SSO / Auth0 tokens

The API also accepts an Auth0-issued JWT (the same session your browser uses) as the bearer token. This is intended for first-party, browser-based use — there is no third-party OAuth app registration, client-credentials, or scopes flow for the REST API. For programmatic integrations, use a PAT.

Note

The MCP server has its own OAuth-based connection flow for AI clients. That’s separate from REST API authentication — see the MCP server guide.

Keeping tokens safe

• Never embed a PAT in client-side code or a public repository — the API is server-to-server only.
• Scope integration users to the minimum workspace access required.
• Rotate tokens periodically and on suspected exposure.