Authentication

Every request is authenticated. There are no public topics or unauthenticated channels — knowing a topic name grants nothing.

API keys

Keys look like std_live_…, belong to one project, and are sent as a bearer token:

curl -H "Authorization: Bearer std_live_..." https://api.stdpush.com/v1/notify -d '{"title":"hi"}'

• Stored hashed — we can't read them back, and neither can anyone who reads the database.
• Shown once at creation.
• Independently revocable — delivery stops the moment you revoke.
• Scoped: notifications:write keys can send but never read your history; add notifications:read only where needed.

CLI tokens

stdpush login pairs a machine through browser approval and stores a std_cli_… token — a per-machine credential, listed and revocable under Settings → Connected CLIs. Your password and browser session never touch the terminal.