GalaxyGate Docs

Authentication and tokens ​

Protected API calls need authentication. You create an API token in the panel, copy it once, and send it on every request as an Authorization: Bearer <token> header. This is the intended path for scripts, automation, and CI, and you give each token only the permissions it needs.

There is a POST /v1/login endpoint, but it is the browser sign-in flow, not the way scripts authenticate. It takes an email and password (plus an MFA code if you have MFA enrolled), sends a login-notification email, and returns a short-lived one-day SESSION token. Automation should not call it. Mint a long-lived API token in the panel instead and use that as the bearer.

Create an API token in the panel ​

Sign in to dash.galaxygate.net and open Security > Tokens. Create a token there, give it a name, choose its expiry, and set the exact permissions it holds. The plaintext value is shown once at creation, so copy it right then and store it somewhere safe.

Save the plaintext now

We store only a hash of every token. The plaintext is shown exactly once, at creation. If you lose it you cannot retrieve it. You create a new token and delete the old one.

Use the token ​

Put the token in the Authorization header on every request, as Bearer <token>. A quick way to confirm your token works is to fetch the account it belongs to:

bash
curl "https://api.galaxygate.net/v1/users/@me" \
  -H "Authorization: Bearer $GALAXYGATE_TOKEN"

That returns the authenticated user, for example:

json
{
  "id": "1524141516547502080",
  "name": "panel test 4",
  "email": "[email protected]",
  "flags": ["EMAIL_VERIFIED"]
}

The same header works on every other endpoint:

bash
curl "https://api.galaxygate.net/v1/instances/$INSTANCE_ID" \
  -H "Authorization: Bearer $GALAXYGATE_TOKEN"

Create a token through the API ​

We expose token creation through a login session. API tokens cannot create other tokens. Follow Create a user token for POST /v1/users/{uid}/tokens, or its POST /v1/tokens alias, including expiry constraints and the one-time plaintext response.

Capability scopes ​

We accept a nonempty scopes array, such as ["instance:write", "image:read"]. Use the available scopes and grant only what the script needs. Omitted scopes grant no access.

Manage and revoke tokens ​

  • List a user's tokens: GET /v1/users/{uid}/tokens. Use @me for {uid} to list your own.
  • Fetch one token's metadata: GET /v1/tokens/{tid}.
  • Delete (revoke) a token: DELETE /v1/tokens/{tid}. It returns 202 Accepted, and the token stops working immediately.

Rotate a token by creating a new one, updating your scripts to use it, then deleting the old one. Because the plaintext cannot be recovered, treat a leaked token as compromised and delete it immediately.

There is no way to refresh an API token to extend its life. A POST /v1/tokens/refresh endpoint exists, but it only extends a browser login SESSION token, and only in the last 6 hours of that token's one-day lifetime. It does not apply to the API tokens you use for automation. To keep automation running past a token's expiry, mint a new token and swap it in.

Next step ​

You have a token. Use it to create your first server.

Create a server