Authentication

Send a Foxora account access token as an HTTPS Bearer credential and validate it against /v1/me before enabling account-dependent work.

Terminal

export FOXORA_ACCESS_TOKEN='<account-access-token>'

curl https://api.foxora.ai/v1/me \
  -H "Authorization: Bearer $FOXORA_ACCESS_TOKEN"

Obtain the token through a supported Foxora authentication or client flow.
Store it outside source code and client-side bundles.
Send Authorization: Bearer … on every protected request.
Treat 401 UNAUTHORIZED as missing, expired, or invalid authentication.
Revoke the associated session and replace the token after suspected exposure.

Foxora does not currently present self-service long-lived user API keys as a public product surface. Never copy internal service credentials from application storage.

Expected result: the request returns the correct account identity; an absent or invalid token returns 401 without exposing account data.