Authentication
Send `Authorization: Bearer` on every `/api/v1` request; token prefixes distinguish OAuth access tokens from personal access tokens.
All /api/v1/* requests require:
Authorization: Bearer <token>
Token prefixes
| Prefix | Kind |
|---|---|
aist_at_… | OAuth access token |
aist_pat_… | Personal access token |
aist_rt_… | OAuth refresh token (token endpoint only) |
aist_client_… | OAuth client id (not sent as Bearer on /api/v1) |
Tokens are opaque and revocable. Treat secrets like passwords — never commit them to git or embed in public repos.
Workspace binding
Every credential is bound to one workspace (photographer_id) at issuance. The API does not accept a client-supplied workspace header to switch tenants. To access another workspace, the user must authorize again (OAuth) or create another PAT for that workspace.
OAuth vs PAT
| OAuth access token | PAT | |
|---|---|---|
| Created via | User consent + /api/oauth/token | Settings → Developer → Personal access tokens |
| Typical clients | Lightroom, mobile, third-party apps | Scripts, traps, CI |
| Revoked via | Connected apps (authorization) or token revoke | PAT revoke/rotate in Developer settings |
Details: OAuth 2.0, Personal access tokens, Developer settings.