Authentication

Bearer token authentication for all API endpoints

All API requests require authentication via Bearer token in the Authorization header.

---

Bearer Token Authentication

Every request to the Melonly API must include a valid Bearer token in the Authorization header:

Authorization: Bearer your_api_token_here

Tokens are server-scoped and inherit the permissions of the user who created them.

Token Security: API tokens provide full access to your server data. Store them securely and never expose them in client-side code or version control.

---

Request Format

cURL

curl -H "Authorization: Bearer your_api_token_here" \
  https://api.melonly.xyz/api/v1/server/info

JavaScript

const response = await fetch('https://api.melonly.xyz/api/v1/server/info', {
  headers: {
    'Authorization': 'Bearer your_api_token_here'
  }
});

Python

import requests

headers = {
    'Authorization': 'Bearer your_api_token_here'
}

response = requests.get(
    'https://api.melonly.xyz/api/v1/server/info',
    headers=headers
)

Go

req, _ := http.NewRequest("GET", "https://api.melonly.xyz/api/v1/server/info", nil)
req.Header.Set("Authorization", "Bearer your_api_token_here")

client := &http.Client{}
resp, err := client.Do(req)

---

Token Context

When using your server token, there’s no need to include server IDs in request paths. The API automatically infers server context from your token.

Correct Usage

GET /api/v1/server/logs
Authorization: Bearer your_server_token

All endpoints under /server/* automatically operate within your token’s server scope.

---

Rate Limiting

Rate limits are enforced per server token for premium users. Review the rate limiting documentation for specific limits and best practices.

Authentication failures and rate limit violations are tracked separately. Multiple authentication failures may result in temporary token suspension.

---

Authentication Errors

Common authentication error responses:

401 Unauthorized - Missing Token

Response:

{
  "error": "authorization header is required"
}

Cause: No Authorization header provided in the request.

401 Unauthorized - Invalid Token

Response:

{
  "error": "invalid or expired token"
}

Causes:

• Token has expired
• Token was revoked or deleted
• Malformed token string
• Token doesn’t exist

403 Forbidden - Insufficient Permissions

Response:

{
  "error": "insufficient permissions for this operation"
}

Cause: Token lacks required permissions for the requested endpoint or operation.

---

Token Management

Generate Token

Create your first API token through the server dashboard

Security Best Practices

Token rotation, storage, and security recommendations

Environment Variables: Store your API tokens in environment variables rather than hardcoding them in your application source code.