Authentication & API Tokens

All requests to the Mojave API must be authenticated.

We support two authentication methods:

1. Personal API Tokens – For backend scripts, internal tools, and CLI usage.

2. OAuth 2.0 – For user-facing apps and third-party integrations (see OAuth guide).

This page covers how to authenticate with API tokens. If you're building a more complex integration that requires user consent, head over to the OAuth2 section.

Generating an API Token

You can create API tokens from your Mojave dashboard under Settings → Developer → API Tokens.

API tokens are scoped to your workspace and role. Keep them secure.

Example Request (Using Curl)

curl -X GET https://api.mojaveapp.com/v1/me \
  -H "Authorization: Bearer YOUR_API_TOKEN"

Required Header

Token Permissions

Each API token inherits the permissions of the user who generated it. If your token belongs to an admin, it will have full read/write access across projects, users, invoices, and time entries.

⚠️ If a team member’s role changes, the permissions of their token also change.

Best Practices

• Keep tokens secret – Never expose them in frontend code or public repos.

• Use environment variables – Store tokens as env vars like MOJAVE_API_TOKEN.

• Rotate periodically – Revoke and regenerate tokens as part of your security process.

• Scope by use – Use different tokens per app or integration for better tracking and revocation.

Token Errors & Troubleshooting

Example error response:

{
  "error": {
    "type": "unauthorized",
    "message": "Invalid API token"
  }
}

Test Your Token

curl https://api.mojaveapp.com/v1/ping \
  -H "Authorization: Bearer YOUR_API_TOKEN"

This will return:

{ "ok": true }

If successful, your token is working and authenticated correctly.