Authentication

Authenticate Pushctl API requests with scoped application bearer tokens.

Send an application token in every request:

Authorization: Bearer push_live_your_token

Tokens belong to one application. A valid token cannot read or change another application’s resources.

Required abilities

Ability	Operations
installations:write	Register and update an installation
installations:read	Get an installation
notifications:send	Send a notification
notifications:read	List and get notifications
events:write	Report a delivery event

Bearer tokens are credentials. Store server tokens in a secret manager, keep them out of URLs and logs, and never put send-capable tokens in mobile code.

Rotation

Create a replacement token with the same or narrower preset, deploy it, confirm successful requests, then revoke the old token from Application settings. Revocation is immediate.