Skip to main content
Every Aether API request carries a Bearer token in the Authorization header:
Aether accepts two kinds of token, and both resolve to your user account:
  • Platform API key — a token prefixed with aether_. This is the credential for programmatic and public API use. Mint it yourself; it does not expire on a timer.
  • Session JWT — a Supabase-issued token the web app obtains when you sign in. It is short-lived and refreshed automatically by the browser client.
For your own scripts and integrations, use a platform API key.

​
Platform API Keys

A platform API key is the credential intended for the public /v1 API. The token starts with aether_ and is shown in plaintext exactly once, when you create it — Aether stores only a hash, so save it somewhere safe.
The command prints the new key once. List and revoke keys with:
Use the key against the /v1 base URL:
A platform API key acts on behalf of your account. Treat it like a password — store it in a secret manager, never commit it, and revoke any key that may have leaked.

​
Session JWT

When you sign in to the web app, Aether issues a Supabase session JWT carrying your user ID. The web app uses it for its own requests and refreshes it automatically. You normally don’t handle this token directly; reach for a platform API key for anything programmatic. The CLI does not keep a session. aether auth login signs you in, exchanges that sign-in for a platform API key named cli-<hostname>, and stores the key — so every CLI request is platform-key authenticated, and revoking that key under Settings → API keys logs the machine out.

​
WebSocket Authentication

The workspace WebSocket at /workspaces/{id}/ws reads the token from the Sec-WebSocket-Protocol header, since browsers can’t set custom headers on a WebSocket. Send bearer followed by your token as subprotocols:

​
Provider API Keys Are Different

Don’t confuse platform API keys with provider API keys. A provider key is an LLM-provider credential (such as OpenRouter) you optionally bring so the agent uses your own account for model calls — “bring your own key” (BYOK). It does not authenticate the Aether API. Manage provider keys with aether apikey:
See connect agent providers for when you need one.

​
Unauthenticated Requests

A request with a missing or invalid token returns 401 Unauthorized: