API Tokens

Every programmatic call to Gaard authenticates with a bearer token. Gaard offers two kinds of credentials for different jobs: API keys scoped to a flow, and personal access tokens tied to your user. This guide shows how to create, scope, and revoke each one.

Prerequisites

An Administrator account to manage API keys in Settings → Platform → Integrations.
The gaard CLI installed if you want to create personal access tokens.

Which credential should I use?

	API key	Personal access token (PAT)
Created in	Settings → Platform → Integrations	The `gaard` CLI
Scope	A single flow	Your user (all tenants you belong to)
Best for	A service or integration that submits video to one flow	The CLI and personal automation
Prefix	A generated key value	`pat_`
Managed by	Any administrator	The token owner

Both are sent the same way: as a bearer token in the Authorization header:

curl -X POST https://vision.gaard.ai/api/classify \
  -H "Authorization: Bearer $GAARD_TOKEN" \
  -F "[email protected]"

Create an API key

An API key belongs to a flow and is the credential most integrations use to submit video.

Open Settings → Platform → Integrations.
Select the API Key integration.
Choose the Flow the key should authenticate against.
Give the key a Name that identifies where it is used, for example edge-uploader.
Copy the generated API Key value and store it securely: treat it like a password.
Select Save. The key appears in the integrations list with its flow.

The key authenticates classify API calls for its flow. See Getting Started for a full request walkthrough.

Create a personal access token

Personal access tokens are user-scoped and created with the CLI. They carry a pat_ prefix and can be given an expiry.

# Create a token
gaard token create --name ci-bot

# Create a token that expires in 30 days
gaard token create --name nightly-job --expires 720h

# List your tokens
gaard token list

For the full command syntax, run gaard token --help.

Rotate and revoke

Rotate credentials on a schedule and whenever one may have been exposed.

API keys: API keys do not rotate in place. To rotate one, create a new API key for the same flow, move your integration to the new key, then delete the old key from the integrations list using its row menu.

Personal access tokens: set an expiry with --expires when you create a token, and revoke a token immediately when it is no longer needed:

gaard token list
gaard token revoke <token-id>

Next steps

Flows Scope keys and webhooks to a flow.

Choosing a Delivery Method Polling, webhooks, or SFTP.