Skip to main content
ClosedVPN authenticates API requests with a Personal Access Token (PAT) sent in the Authorization header. This page covers how to get your first token, how to use it, and how to manage its lifecycle.

​
Getting your first token

Creating a token requires an authenticated session, so the very first token comes from signing in. There are two routes.
  1. Sign in at closedvpn.io using the magic link sent to your email address.
  2. Open the Profile page.
  3. Choose Create token, give it a name, and optionally set an expiry.
  4. Copy the token immediately — it is shown only once.
The value in the pat field is the only time the plaintext token is available. It is stored as a bcrypt hash, so it cannot be recovered. If it is lost, revoke it and create a new one.

​
Using your token

Send the token as a Bearer credential on every request.
The first time a magic link is verified, a default organization named My Org is created with you as its owner, and the first available VPN is assigned to it. So a new account can call organization endpoints immediately.

​
Organization context

Endpoints that act on a single organization either take an explicit org_id, or fall back to your selected organization.
GET /auth/vpn-exit-nodes requires a selection and returns 400 without one. GET /auth/threat-prevention-stats accepts an optional org_id and falls back to the selection.

​
Roles

Each member of an organization is either an owner or a member. Owner-only operations are: updating and deleting the organization, adding members, changing roles, and removing members. Attempting one as a member returns 403. Two guards apply to owners: you cannot change your own role, and the last remaining owner can neither leave nor delete their only organization.

​
Managing tokens

GET /auth/get-pats returns your active tokens. Only the bcrypt hash of each is returned, never the plaintext. Tokens whose expiry has passed are deactivated as a side effect of this call and excluded from the result.
POST /auth/delete-pat deactivates a token. Pass the hash returned by GET /auth/get-pats in the token field, not the plaintext value.
Pass expiryDays when creating a token to set a lifetime. Omit it for a token that never expires. An expired token returns 403.
POST /auth/logout clears the browser session cookie only. It does not revoke Personal Access Tokens and has no effect on API clients. Use /auth/delete-pat to revoke a token.

​
Authentication errors

A 403 where you expect success usually means the token is fine but your role is insufficient, or you are not an active member of the target organization.