Authentication

Bearer tokens

Send a token in the Authorization header:

Authorization: Bearer sk_live_...

Accepted tokens:

Token	Created by	Best for
Personal access token	You, under Profile, Tokens	Scripts, the CLI
Service-account token	An admin	Automation and integrations
Job token	Issued to a running job (OIDC JWT)	Calling Slipway from inside a pipeline, within permissions:

Tokens carry scoped permissions and an expiry and are hashed at rest. See Access control.

If you belong to several organisations, the token’s organisation applies. For session users you can pick the active organisation with the X-Slipway-Org header (validated against your membership).

Session cookie

The browser app uses the slipway_session cookie. For mutating calls with cookie auth you must also send an X-CSRF-Token header. Bearer-token calls need no CSRF token.

Request pipeline

Each request passes through, in order: panic recovery, tracing, authentication, organisation context (which sets the Postgres row-level-security scope), entitlement checks (plan limits), rate limiting, then your handler.

Other HTTP endpoints

Endpoint	Purpose
GET /healthz, GET /readyz	Liveness and readiness
GET /metrics	Prometheus metrics
GET /.well-known/openid-configuration, /.well-known/jwks.json	Job-token OIDC discovery and keys
GET /badges/{project}/{pipeline}.svg	Status badges
GET /api/v1/openapi.json	OpenAPI description
POST /hooks/scm/{provider}/{connection_id}	SCM webhooks (signature verified first)
POST /hooks/integrations/{provider}/{integration_id}	Integration webhooks
POST /hooks/generic/{pipeline_id}	Generic pipeline webhook trigger
POST /hooks/stripe	Billing webhooks

Example: who am I

curl -sS https://slipway.example.com/slipway.v1.IdentityService/WhoAmI \
  -H "Authorization: Bearer $SLIPWAY_TOKEN" -H "Content-Type: application/json" -d '{}'