Authentication
The REST API is authenticated with bearer tokens. Every token is scoped to exactly one database — a token minted for one database can never be used against another, even by the same account.
Sending a token
Pass the token in the Authorization header on every request:
Authorization: Bearer wsq_1a2b3c4d5e6f...Abilities
Each token has one of two access levels, chosen when it's created:
| Ability | Can run |
|---|---|
| Read-only | SELECT, EXPLAIN, PRAGMA, and WITH (CTE) statements. |
| Read & write | Everything — including INSERT, UPDATE, DELETE, and DDL like CREATE TABLE. |
If a request includes even one statement that needs write access and the token is read-only, the entire request is rejected with a 403 before anything runs.
Errors
| Status | Meaning |
|---|---|
401 | Missing or invalid token. |
403 | Token is valid but not scoped to this database, or lacks the write ability. |
Revoking access
Delete a token from the Tokens tab at any time. Revocation is immediate — the next request made with that token fails with 401.