Authentication

Safe AI Workbench uses Bearer token authentication. Include your API key in the Authorization header:

Authorization: Bearer YOUR_API_KEY

You can find your API key on your dashboard. API keys start with gha_.

For browser-based applications, authenticate users with JWT tokens obtained after login:

// Login with email/password or passkey
const loginRes = await fetch('/api/auth/login', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify({
    email: 'user@example.com',
    password: 'your_password'
  })
});

const { token } = await loginRes.json();

// Use token in subsequent requests
const chatRes = await fetch('/api/ai/chat', {
  method: 'POST',
  headers: {
    'Authorization': `Bearer ${token}`,
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({ ... })
});

JWT tokens are short-lived (24 hours) and automatically include user context (org, groups, roles).

Users can authenticate with passkeys for passwordless, phishing-resistant login:

• Supported on modern browsers (Chrome, Safari, Edge, Firefox)
• Uses device biometrics (Face ID, Touch ID, Windows Hello)
• No password to remember or compromise
• FIDO2/WebAuthn compliant

Users can enroll passkeys from their account settings after initial login.