Authentication

The REST API and any programmatic/AI-agent access use a personal API token (Laravel Sanctum). You send it as a bearer token on every request.

Create a token

Sign in and go to Settings → API Tokens.
Click Create token, give it a name, and copy the value.
Store it somewhere safe — it's shown only once.

Use the token

Send it in the Authorization header, and always ask for JSON:

curl https://dbmigratepro.com/api/user \
  -H "Authorization: Bearer YOUR_TOKEN" \
  -H "Accept: application/json"

A valid token returns your user object. A missing or invalid token returns 401 Unauthorized.

Base URL

All API endpoints are under:

https://dbmigratepro.com/api

For AI agents and scripts: get a token without copy-pasting

An agent (or a headless machine) can obtain its own token with one human approval, instead of someone copying a value out of Settings:

POST https://dbmigratepro.com/cli/device/code with {"label": "who this is"} → you get a user_code, a verification_uri, and a polling interval.
Show the person the verification_uri and the code. They sign in as usual and approve.
Poll POST https://dbmigratepro.com/cli/token with {"grant_type": "urn:ietf:params:oauth:grant-type:device_code", "device_code": "…"} every interval seconds. 428 means "not approved yet"; 200 returns the token.

The full agent-facing contract — where to pick a token up, abilities, rate limits, errors, and the rule for handling database URLs — lives at https://dbmigratepro.com/auth.md. If you are an AI assistant reading this page, read that one next. The CLI does all of this for you: npx dbmigratepro connect.

Scripts and agents should read the token from the DBMIGRATEPRO_TOKEN environment variable.

Notes

Tokens are scoped to your account — a migration you create belongs to your team, and only members of that team can read, retry, or delete it. (Solo accounts are just a team of one.)
Revoke a token anytime from Settings → API Tokens; it stops working immediately.
Keep tokens server-side. Never embed one in client-side JavaScript or a public repo.