Private API authentication

Use the Private API with a dashboard-generated API token in the Authorization header:

Authorization: Bearer YOUR_TOKEN_HERE

Base URL:

https://pagoti.com/api/v1

Token model

Each dashboard-created token is limited to one project, governed by your current plan, and assigned read access, write access, or both.

How access is checked

For project-scoped private endpoints, Pagoti checks requests in this order:

1. the token is valid
2. the token is scoped to the requested project
3. the token has the required access level for the HTTP method

Access levels

Read access

Read access is required for GET requests on project-scoped private endpoints such as:

• GET /projects/{project}
• GET /projects/{project}/pages
• GET /projects/{project}/pages/{page}
• GET /projects/{project}/media

Write access

Write access is required for mutating requests on project-scoped private endpoints such as:

• PUT /projects/{project}
• DELETE /projects/{project}
• POST /projects/{project}/pages
• PUT /projects/{project}/pages/{page}
• DELETE /projects/{project}/pages/{page}

Disabled tokens

If a token has neither read nor write access, project-scoped private API requests return 403 Forbidden.

Creating and managing tokens

1. Go to Dashboard -> API Tokens
2. Create a token for the project you want to access
3. Choose whether it should have read access, write access, or both
4. Copy the token immediately

The plain-text token is only shown once.

Example request

curl https://pagoti.com/api/v1/projects \
  -H "Authorization: Bearer YOUR_TOKEN_HERE" \
  -H "Accept: application/json"

Examples

Read request:

curl https://pagoti.com/api/v1/projects/abc123de/pages \
  -H "Authorization: Bearer YOUR_TOKEN_HERE" \
  -H "Accept: application/json"

Write request:

curl https://pagoti.com/api/v1/projects/abc123de/pages \
  -X POST \
  -H "Authorization: Bearer YOUR_TOKEN_HERE" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"name":"New page","description":"A short summary"}'

Status codes

• 401 Unauthorized when the token is missing or invalid
• 403 Forbidden when the token cannot access the project
• 403 Forbidden when the token lacks the required read or write access
• 429 Too Many Requests when the plan rate limit is exceeded

Example error responses

Missing token

{
  "message": "Unauthenticated."
}

Wrong project scope

{
  "message": "Forbidden. Token does not have access to this project."
}

Missing read ability

{
  "message": "Forbidden. Token does not have read access."
}

Missing write ability

{
  "message": "Forbidden. Token does not have write access."
}

Notes

• Private API route parameters use project and page hash_id values
• Never expose Private API tokens in browser code
• Use the Private API overview as the entry point for endpoint guides