Authentication - e6data Docs

Send a token as a bearer token:

curl -H "Authorization: Bearer <token>" https://<host>/...

Which credential to use

Caller	Credential	Where to get it
You, from a script or notebook	Personal access token	Create, rotate and revoke tokens
Apps, pipelines and CI	Service account key (service token)	Created under Access Control in the console. See Users, groups and service accounts.
SQL over REST sessions	Session token from `POST /api/v1/authenticate`	Authenticate

The SQL over REST API also accepts a personal access token, or an SSO/OIDC JWT, directly as the bearer token.

Permissions

Each call is checked against role-based permissions. A 403 response names the permission the call needs, so you can grant least privilege. See Roles and permissions and the permissions matrix.

Keep tokens safe

A raw token is shown exactly once. Store it in a secret manager when you create it.
Use one credential per consumer. Set an expiry and rotate it before it lapses.
Never log or commit the secret. Log the token ID instead.

More in Token security best practices.

Last modified on September 29, 2026