Authorization
Callaba Engine uses an API token to authorize protected requests. Generate the token in the dashboard and send it with every protected API call.
Choose this whenA trusted backend service needs to call protected Engine endpoints.
Use another module whenUse a public viewer or join endpoint only when that exact method is marked Public.
Before you start
- Sign in to the Callaba dashboard.
- Open General settings and generate an API token.
- Store the token in a secret manager or protected environment variable.
- Send requests to your own Callaba Engine base URL over HTTPS.
What you can do
Add the token as the x-access-token request header:
curl --request POST \
--url https://YOUR_CALLABA_HOST/api/MODULE/METHOD \
--header 'content-type: application/json' \
--header 'x-access-token: YOUR_API_TOKEN' \
--data '{}'Use the same header for list, create, update, lifecycle, and statistics methods unless a method is explicitly documented as public.
Example workflow
- Load the token only in your backend process.
- Call a read method with the header to verify the base URL and token.
- Handle authorization failures before enabling write operations.
- Rotate the token if it is exposed or no longer needed.
Common use cases
- Authorize a control panel that starts and stops live workflows.
- Allow a scheduler to create recordings for booked events.
- Give a deployment worker access to configure a new Engine instance.
Limits and troubleshooting
A missing, invalid, or revoked token causes protected requests to fail. Do not put the token in browser JavaScript, a public repository, a URL, or client-side logs. Public viewer and join methods have their own documented access rules and do not make protected lifecycle methods public.
Next steps
Verify authorization with a read method, then open the module guide for the resource you want to manage.