Authentication

To securely access and interact with Sourcebot’s API, authentication is required. Users must generate an API Key, which will be used to authenticate requests.

If anonymous access is enabled, some endpoints will be accessible without a API key.

Creating an API key

Navigate to Settings → API Keys and click Create API Key. Copy the value - it is only shown once.

Using an API key

Pass your API key as a Bearer token in the Authorization header on every request.

Authorization: Bearer <your-api-key>

For example, to call the /api/search endpoint:

curl -X POST https://your-sourcebot-instance.com/api/search \
  -H "Authorization: Bearer <your-api-key>" \
  -H "Content-Type: application/json" \
  -d '{"query": "hello world", "matches": 10}'

Using a scoped access token

Scoped access tokens are short-lived bearer credentials intended for clients that should only access a specific set of repositories. Create one with a Sourcebot API key by calling POST /api/ee/scoped_access_token with repository names:

curl -X POST https://your-sourcebot-instance.com/api/ee/scoped_access_token \
  -H "Authorization: Bearer <your-api-key>" \
  -H "Content-Type: application/json" \
  -d '{"repos": ["github.com/acme/frontend", "github.com/acme/backend"]}'

The response contains an opaque token beginning with sbst_. It expires exactly one hour after issuance, cannot be refreshed, and is returned only once. Use it as a Bearer token with public API endpoints or the Sourcebot MCP server:

Authorization: Bearer <your-scoped-access-token>

Repository scope is bound internally to repository IDs and is also intersected with the creating user’s current repository permissions. Creating and revoking scoped access tokens requires an API key; a scoped access token cannot mint or revoke tokens.