Skip to main content
AI Review uses Better Auth for authentication. Two methods are supported depending on your use case.

​
Session-based authentication (browser)

When you log in to the web dashboard, Better Auth sets a secure HTTP-only session cookie. All subsequent requests from the browser automatically include this cookie. This method is not suitable for programmatic API access from outside the browser.

​
API key authentication

For scripts, CI pipelines, and external tooling, use an API key.

​
Create an API key

  1. Log in to the web dashboard.
  2. Navigate to Settings → API Keys.
  3. Click Generate new key and copy the value — it is shown only once.

​
Use the API key

Pass the key in the Authorization header: 
curl -X GET https://your-domain.com/api/reviews \
  -H "Authorization: Bearer <api-key>"
Alternatively, runners use the x-api-key header: 
curl -X POST https://your-domain.com/api/runners/register \
  -H "x-api-key: <api-key>"
API keys are verified against the Better Auth API key store. Each key is tied to the user who created it and inherits that user’s permissions.

​
Which endpoints require authentication

EndpointAuth required
GET /api/healthNo — public, used for load balancer checks
POST /api/webhook/gitlabNo session required — validated by webhook token
POST /api/webhook/githubNo session required — validated by HMAC signature
All other /api/* endpointsYes — session cookie or API key

​
Permissions

Some write operations additionally require specific permissions beyond being authenticated:
  • POST /api/reviews/trigger-manual-review — requires review:create
  • POST /api/projects/sync/platform — requires project:create
  • PATCH /api/projects/:projectId — requires project:update
  • POST /api/platform-configs — requires config:create
  • PATCH /api/platform-configs/:id — requires config:update
  • DELETE /api/platform-configs/:id — requires config:delete
  • GET /api/platform-configs/:id/access-token — requires admin role
Store API keys securely. Never commit them to source control or expose them in client-side code.

Build docs developers (and LLMs) love

Get started for freeTalk to us