Authentication & scopes

Personal access tokens

The Brila API uses personal access tokens, not OAuth. A token acts on your own account only — there's no concept of one user's token accessing another user's data. Tokens are created and revoked from Settings → API Tokens.

Send the token as a bearer token on every request:

Authorization: Bearer brla_...

Requests without a valid, non-revoked, non-expired token get a 401.

Scopes

Each token is granted a specific set of scopes when it's created. A scope grants access to one action on one resource — for example:

Scope	Grants
discount_codes:read	List and fetch your discount codes
discount_codes:write	Create, update, and delete your discount codes

A request that needs a scope the token doesn't have gets a 403:

{
  "error": {
    "code": "forbidden",
    "message": "This token is missing the required scope: discount_codes:write",
    "details": null
  }
}

Create a token with only the scopes it actually needs — a read-only integration should use a read-only token.

Revoking a token

Revoking a token from Settings takes effect immediately; any request using that token afterward gets a 401. Revoking is permanent — create a new token if you need to reconnect an integration.