Authentication - Provisionr

The Workspace API uses Bearer token authentication. Include your token in the Authorization header of every request.

curl https://wksusa1b2c3d.provisionr.app/api/v1/directory/users \
  -H "Authorization: Bearer prv-your-token"

Token Types

Provisionr supports several token types depending on your use case.

Token Type	Use Case	Expiration
CLI Access Token	Interactive CLI usage	60 minutes
CLI Refresh Token	Refreshing CLI access tokens	30 days
Personal Access Token	Local scripts and testing	4 hours
Service Account Token	Automated workflows and CI/CD	Configurable

Service accounts are designed for automated workflows and integrations. Create a service account and generate a token from the Workspace UI.

Visit https://wks{region}{7char}.provisionr.app and sign in.

Navigate to Service Accounts

In the left sidebar, navigate to the Service Accounts section.

Create a Service Account

Create a new service account with the appropriate role and permissions for your use case.

Generate a Token

Generate a bearer token for the service account. Store the token securely as it will only be shown once.

Use the authentication test endpoint to verify your token is valid.

curl https://wksusa1b2c3d.provisionr.app/api/v1/auth/test \
  -H "Authorization: Bearer prv-your-token"

{
    "token_type": "service_token",
    "workspace_id": "hqwks_01hq8xyzabc123def456",
    "expires_at": "2026-03-15T00:00:00Z"
}

You can also test connectivity without authentication using the ping endpoint.

curl https://wksusa1b2c3d.provisionr.app/api/v1/auth/ping

Requires Token	Endpoint	Description	Rate Limit
No	`GET /auth/ping`	Unauthenticated API connectivity test	500 per minute
Yes	`GET /auth/test`	Test API token is valid	200 per minute
Yes	`GET /auth/version`	Get environment and version data	10 per minute