Authentication

Tensoit provides two credential types depending on where your code runs.

Server token vs Widget key

	Server API token	Widget public key
Format	{id}|{secret}	pk_live_...
Use in	Backend / server only	Browser JavaScript
Endpoints	Full /v2/*	/widget/v2/* autocomplete only
Browser safe	No	Yes (with domain allowlist)

Server API token (Bearer)

All /v2 routes are protected with Sanctum token auth.

Header

Authorization: Bearer {token_id}|{plain_text_token}
Accept: application/json

How to obtain a token

Create an API (server) token in the Tensoit client panel and keep it server-side.

Widget public key (browser)

For frontend autocomplete, create a Widget (JS) key in the client panel and follow the JavaScript Widget guide.

Flow:

1. POST /widget/v2/session with X-Public-Key: pk_live_... and browser Origin
2. Receive short-lived sess_... session (15 min)
3. Call autocomplete with Authorization: Bearer sess_...

Widget keys are restricted to allowed domains and cannot access server-only endpoints.

Token errors

Common auth failures:

• 401 Unauthorized - missing or invalid bearer token / session
• 403 Forbidden - token inactive, expired, or domain not allowed

Always send server tokens over HTTPS and never expose them in frontend source code.