Authentication
Choose the right ActionBox credential for people, browsers, and machine integrations.
ActionBox has two authentication boundaries: user sessions for people and Source keys for software. Keeping them separate limits what a browser, teammate, or automation can see and change.
User session
People sign in to the dashboard and use user-scoped credentials for account actions.
Source key
Machine calls use one Source-scoped axb_live_ key in an Authorization header.
Provider sign-in
Use an available sign-in provider to access your ActionBox account.
Choose a credential
| Caller | Credential | Typical calls |
|---|---|---|
| Browser dashboard | Signed-in user session | Hosted dashboard and user-scoped resources |
| Script, worker, CI job, or agent | axb_live_… Source key | Create, update, resolve, cancel, and report outcomes for that Source |
Never swap the boundaries
A Source key is not a dashboard login, and a user session is not a machine identity. Keep Source keys out of browser bundles, URLs, logs, screenshots, and source control.
Sign in on the web
The dashboard can use the sign-in methods that are enabled for your ActionBox account. The provider list is public, so a client can discover which methods are available:
curl https://api.actionbox.cloud/v1/auth/providersThe browser flow is:
1. Start the provider flow
Open the provider start route with a local destination such as /actions:
GET /v1/auth/google/start?next=/actionsActionBox takes you to the selected sign-in provider.
2. Complete provider sign-in
If sign-in succeeds, ActionBox returns you to the dashboard.
3. Continue to the dashboard
Your account and workspace access appear in the dashboard. If you are building an integration, use a Source key for machine requests rather than copying a browser session.
Sign-in availability and account access rules depend on your ActionBox account. Check /v1/auth/providers before presenting a sign-in option; do not assume that every provider is available.
Sign out safely
- Call
POST /v1/auth/logoutfor the current user session. - Rotate or revoke a Source separately if its machine credential may have leaked.
Next: Create a Source for your first machine integration, or return to the Getting Started guide.