Authentication

The ServerOps API uses Bearer token authentication. Every request must include a token in the Authorization header.

Header format

Authorization: Bearer so_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxx

Tokens begin with so_live_ for production and so_test_ for test environments.

Creating tokens

Tokens are created from your dashboard. When creating a token you choose:

• Name: a label for your reference (e.g. "FiveM Production Server")
• Scopes: what the token is allowed to do

Scopes

Scopes follow the pattern product:action. A token only grants access to the specific operations listed - all others return 403 Forbidden.

Principle of least privilege

Issue tokens with only the scopes they need. A script that only uploads files should have media:write and nothing else. If that token is ever compromised, the blast radius is limited to file uploads.

Token storage

Never hardcode tokens in source code. Use environment variables or platform-specific config:

Error responses

401 Unauthorized

The token is missing, malformed, or has been revoked.

{
  "error": {
    "code": "unauthorized",
    "message": "missing or invalid token"
  }
}

Check that the Authorization header is present and the token value is correct.

403 Forbidden

The token is valid but does not have the required scope for the operation.

{
  "error": {
    "code": "forbidden",
    "message": "token does not have media:write scope"
  }
}

Create a new token with the correct scope.

Token rotation

Rotate tokens periodically or immediately if you suspect they have been exposed:

1. Create a new token with the same scopes.
2. Update your server config to use the new token.
3. Delete the old token from the dashboard.

There is no downtime if you update and reload your server config before deleting the old token.