API Authentication

API Authentication

FlightStack uses JWT (JSON Web Tokens) for API authentication.

Obtaining a Token

Via CLI

flightstack login

After authentication, tokens are stored at ~/.flightstack/config.json.

Via API

POST /auth/login
Content-Type: application/json

{
  "email": "you@example.com",
  "password": "your-password"
}

Response:

{
  "accessToken": "eyJhbG...",
  "refreshToken": "eyJhbG...",
  "expiresAt": "2024-01-01T00:00:00Z"
}

Using the Token

Include the token in the Authorization header:

curl -H "Authorization: Bearer <access_token>" \
  https://api.flightstack.dev/repository

Token Refresh

Access tokens expire after 1 hour. Use the refresh token:

POST /auth/refresh
Content-Type: application/json

{
  "refreshToken": "eyJhbG..."
}

Agent Authentication

Build agents use a separate token system:

curl -H "Authorization: Bearer <agent_token>" \
  https://api.flightstack.dev/buildagent/poll

Agent tokens are obtained during flightstack agent register.