Skip to main content
Platform API Docs

Authentication and Client Lifecycle

Register clients, request scopes, protect one-time credentials, and rotate or revoke access.

Version Public contract v1 Generated references follow approved public contract hashes Reviewed Jul 26, 2026 Next review Oct 26, 2026
Start Reading Report documentation issue Try in a Free Developer Workspace

The free Developer workspace is for non-production building and learning under published limits. External API or MCP client credentials use a separate scoped request and approval process.

Owner: Batoi Developer Experience Reviewed by: Batoi Platform Security Source revision: upgrade-jul-26-2026

Browse Batoi Platform API Documentation Authentication and Client Lifecycle
On this page

Authentication and Client Lifecycle

New clients

New API clients use both:

  • X-Batoi-Client-Id with the public client identifier.
  • Authorization: Bearer <credential> with the one-time revealed credential.

The credential is bound to the gateway UID, environment, audience, approved scopes, lifecycle status, and optional expiry. A credential for one sandbox gateway cannot be replayed against another gateway or production.

Onboarding lifecycle

  • Request or receive a developer invitation.
  • Register the application or client and accountable owner.
  • Request the minimum operation scopes.
  • Receive approval and sandbox access.
  • Copy the one-time credential directly into a secrets manager.
  • Complete a first sandbox call and retain its correlation identifier.
  • Request production promotion only after validation.
  • Rotate before expiry and revoke unused or suspected credentials.

Storage guidance

Never place credentials in browser storage, source control, screenshots, documentation, prompts, generated code, logs, or support bundles. Keep credentials in a server-side environment or managed secrets store.

Legacy compatibility

Some existing RAD API consumers may still use JSON-body keys. That contract is compatibility-only, is excluded from new examples, and is subject to measured deprecation. Do not build new integrations with it.