Authentication

Permissions and project access

Personal API tokens belong to your account and use your current project permissions. A token with chat:write can start the same agent actions and credit usage as a message you send in Amazi, including access to other projects you are authorized to use. Tokens are not limited to a single project.

Create and manage tokens

Use your signed-in account session for POST /auth/api-tokens, GET /auth/api-tokens and DELETE /auth/api-tokens/{tokenId}. API tokens cannot manage other tokens. If you sign in with a password, POST /auth/token with JSON email and password returns an account session token; send it as Authorization: Bearer when managing API tokens. Browser sessions can use their existing session cookie from an allowed Amazi origin.

Create a token with a name, one or both scopes (chat:read, chat:write), and an ISO UTC expiresAt within the next 365 days:

{"name":"My automation","scopes":["chat:read","chat:write"],"expiresAt":"2026-12-01T00:00:00.000Z"}

Choose a future date when running the request. Creation returns HTTP 201 with token (the secret, shown once) and item (ID, name, prefix, scopes and timestamps). Save token in your server's secret storage. Listing returns items without secrets. Delete by item.id to revoke it; success returns HTTP 204. Up to 20 unexpired, unrevoked tokens are allowed per account. Token settings are currently available through these API operations, without a dedicated settings screen.

Authenticate requests

Send Authorization: Bearer amz_api_... to the project chat endpoints over HTTPS. Account session tokens and cookies are not accepted for these chat operations. Keep API tokens out of browser code, URLs and logs. Logging out does not revoke personal API tokens. Revocation blocks future requests but does not cancel work already accepted.

Limits and errors

Each token allows 60 requests per minute. HTTP 429 includes Retry-After in seconds. HTTP 400 means invalid input, 401 an invalid/expired/revoked token, 403 insufficient scope or permissions, 404 an unavailable project or chat, and 409 a conflicting operation such as sending to an archived chat. Check the returned error message for recovery. These authenticated endpoints are intended for server integrations and do not inherit the anonymous catalog's cross-origin browser policy.