Team & security
API tokens (personal and workspace)
Personal access tokens for using the MarvX API as yourself, and scoped workspace tokens for servers and CI using the Storage API.
Tokens are shown once at creation. Store them in a secret manager; never commit them.
| Personal token | Workspace token | |
|---|---|---|
| Prefix | mv_ | mvw_ |
| Created in | Settings → Personal tokens | Team → API tokens (owners, admins) |
| Acts as | You, in all your workspaces, with your role | The workspace, limited to its scopes |
| Can call | The whole API | Storage API only |
| Survives you leaving | No | Yes |
Base URL https://api.marvx.io/v1, header Authorization: Bearer <token>. Responses are {"data": …}; errors {"error": {"code", "message"}}.
Personal tokens
- Settings → Personal tokens → Create a token: Name (e.g.
ci-deploy), Expires (30 days, 90 days, 1 year or never). - Generate token, copy it.
- Revoke stops it immediately. The list shows prefixes and last use.
curl -s -X POST "https://api.marvx.io/v1/apps/$APP_ID/deployments" \
-H "Authorization: Bearer $MARVX_TOKEN"Useful endpoints: GET /apps?org_id=…, GET /apps/{id}, GET|PUT /apps/{id}/env, POST /apps/{id}/deployments, GET /apps/{id}/deployments, POST /deployments/{id}/rollback, GET /apps/{id}/logs, POST /apps/{id}/restart. Your role applies: a Viewer's token can't deploy.
Workspace tokens
- Team → API tokens → Create token: a Name, Permissions (Read storage, Write files, Manage buckets) and an expiry.
- Up to 50 per workspace. The list shows creator, last use, and Expired / Revoked status.
They work only on Storage API routes their scopes allow (403 insufficient_scope otherwise), need no org_id, and are rate limited per token. See Object storage.
Errors
| Status | Meaning |
|---|---|
| 401 | Missing, invalid, expired or revoked token |
| 403 | Role or scopes don't allow it |
| 402 | Plan limit reached (quota_exceeded) |
| 429 | Too many requests; retry later |