Skip to content
endlesstesting.ai

Authentication

Protected routes take a Bearer token:

Authorization: Bearer et_acct_...

Account token

Section titled “Account token”

et login stores an account token at ~/.config/endlesstesting/token. The same value in ET_TOKEN overrides the file. Account tokens use the et_acct_ prefix. The token acts as that account. A token for one account cannot read another account’s site. A session that does not own a site gets 404. A key for a different site gets 403.

Terminal window
curl https://api.endlesstesting.ai/api/auth/verify \
  -H "Authorization: Bearer $ET_TOKEN"

Domain key

Section titled “Domain key”

Some routes also accept a domain key. The key uses the et_live_ prefix and is limited to one site. Send it as Authorization: Bearer or as X-API-Key.

Which routes take a session, an account token, or a domain key is on the API page.

Public routes

Section titled “Public routes”

The SDK calls these from visitor browsers. They take no token:

  • GET /api/sdk.js: the SDK script
  • POST /api/events: event tracking
  • GET /api/tests/by-url-allocations: variant allocation
  • GET /api/tests/by-url: variant lists for the on-site preview
  • GET /api/conversion-metrics/:domainId: goal keywords for the page
  • GET /api/health: health check