Every non-public method requires a bearer token in the Authorization header:

Authorization: Bearer <token>

peinture accepts two kinds of bearer token there — a short-lived access token for interactive sessions, and a long-lived personal access token for scripts and other apps.

Access & refresh tokens

Call auth.login with an email and password to receive a pair:

• an access token — a JWT with a 15-minute lifetime, sent as Authorization: Bearer <token> on every call;
• a refresh token — used to obtain a new pair without re-entering the password.

Refresh proactively before the access token expires. On a token_expired (1002) error, call auth.refresh once with your refresh token and retry the original request. Refresh tokens slide on each use up to a 90-day absolute session cap, after which the user must log in again.

auth.logoutAll revokes every session for the user — every issued access and refresh token, including the one making the call.

Personal access tokens

To authorize another application without sharing your password, mint a personal access token (PAT) with token.create. Send it exactly like an access token — Authorization: Bearer pnt_… — but it never needs refreshing: it stays valid until it expires (if you set an expiry) or you revoke it.

• The secret (pnt_…) is shown once at creation; only a hash and a short hint are stored.
• A PAT is never an admin token and may call only the image.* methods plus the upload and archive HTTP routes. Everything else returns forbidden (1003).
• Revoke a PAT individually with token.revoke; it does not affect your other tokens or your password sessions.

The token.* and account.* methods are self-management and are reachable only with a password-session access token, never a PAT.