Authentication
Two planes of auth, Better Auth JWTs for the dashboard and MCP, and ak_ API keys plus pt_ public ingest tokens for programmatic access. What each is for, and how the Go API verifies them.
axonpush authenticates two very different callers: a person in the dashboard, and a process sending or reading telemetry. Each has its own credential.
Dashboard sessions and JWTs
Dashboard sign-in is owned by the Bun authsvc running Better Auth. It manages sessions, email verification, Google sign-in and organisation membership, and it issues EdDSA JWTs signed with a rotating key. The Go API fetches the JWKS and verifies those tokens locally, so a dashboard or MCP request needs no round trip back to the auth service.
You send a session JWT as a bearer token:
Authorization: Bearer <jwt>This is the credential for dashboard and operator endpoints, and for the MCP server, where the OAuth flow signs you in through Better Auth in the browser rather than asking you to paste a token.
API keys
An ak_ API key is the credential for server-side code, an SDK, an OTLP
collector, a backend service. Send it in the X-API-Key header. A key is scoped
to an organisation, and optionally pinned to an app and an environment.
X-API-Key: ak_...Keys can be minted, listed and revoked from the dashboard. A key can carry
allowEnvironmentOverride to let a single key write into more than one
environment; without it, a pinned key rejects a mismatched environment override
rather than silently ignoring it. See Environments.
Never ship an ak_ key to a browser or mobile app, it is a key everyone who
downloads the client then holds. Use a public ingest token instead.
Public ingest tokens
A pt_ public ingest token is the credential for untrusted clients,
browser and mobile code. Send it in the X-Public-Token header. A token is
minted against exactly one channel and one environment and can only publish
there, so shipping it to every user is safe: it cannot read data, cannot address
another environment, and cannot be moved by a header.
X-Public-Token: pt_...Which credential for what
| Caller | Credential | Header |
|---|---|---|
| Dashboard / operator UI | Better Auth JWT | Authorization: Bearer |
| MCP client | Better Auth JWT (browser OAuth) | handled by the client |
| Server-side SDK, OTLP, Sentry | API key | X-API-Key |
| Browser / mobile ingest | Public ingest token | X-Public-Token |
Related
- Architecture, the authsvc and the Go verifier
- Environments, how a credential resolves an environment
- MCP, browser sign-in for coding agents
Custom dimensions
Every attribute you stamp on a span or event becomes a queryable dimension. How axonpush discovers them, how to slice by them, and how to name them so they stay useful.
Environments
How dev, staging and prod isolation works, where an environment lives, how ingest resolves one per request, and what happens when a request asks for an environment its credential is not allowed to write to.