API authentication overview

Overview

Bastion supports two authentication methods:

Method	Security Level	Use Case
API Key (Bearer Token)	Standard	Server-to-server requests
API Key + Request Signing	Enhanced	High-security operations

Bastion API keys use the bas_ prefix:

bas_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

API Keys can be created through your dashboard in the API keys tab:

Include your API key as a Bearer token:

curl -X GET https://api.prod.bastion.com/v2/accounts \
  -H "Authorization: Bearer bas_your_api_key_here"

Security:

For higher-security operations, add asymmetric request signing using ECDSA P-256 keys.

Sign a JWT claim containing:

Claim	Description
`iat`	Timestamp (must be within 30 seconds)
`req-method`	HTTP method
`req-path`	Request path
`body`	SHA-256 hash (hex-encoded) of the request body; omit for `GET`/`HEAD`

Bastion validates the signature and timestamp before processing. Requests outside the 30-second window are rejected to prevent replay attacks.

Follow the API Request Signing Guide for a full overview of the API request signing process with examples.