​Authentication

Scrub uses Bearer auth for every protected request. There are two ways to get a token.

​Auth flow

1. Sign up — create an account and verify your email.
2. Log in — exchange credentials for a short-lived access token (and a refresh token).
3. Call the API — send Authorization: Bearer <token> on each request.
4. Refresh — when the access token expires, use the refresh token to get a new one without logging in again.

For server integrations, skip the login loop: create an API key in Token Management and use that Bearer token from your backend.

​JWT (dashboard / interactive)

Use this for the Scrub dashboard and any session-based client.

POST /api/v1/auth/login
Content-Type: application/json

{
  "email": "you@company.ng",
  "password": "your_password"
}

Attach the returned access token:

Authorization: Bearer <access_token>

When it expires, refresh:

POST /api/v1/auth/refresh
Content-Type: application/json

{ "refresh_token": "<refresh_token>" }

​API key (server-to-server)

Use this for Detect, Financial Report, and other programmatic calls from your backend.

1. Sign in to the dashboard
2. Open Token Management and create a key
3. Send it as Authorization: Bearer <api_token>

Do not embed API keys in frontend code.

​Request headers

Next: Getting Started · Webhooks