Authentication

Use a Bearer token in the Authorization header to access the API. The service accepts two token types:

• JWT access tokens
• Personal Access Tokens (PAT), which start with pat_

Prerequisites

• A valid API token (JWT or PAT)
• For JWT: your X-Tenant-Id value

If you're unsure how to obtain these, contact our support team at support@dreamhub.ai.

Make Your First Request

With JWT

Headers:

Authorization: Bearer <YOUR_JWT>
X-Tenant-Id: <YOUR_TENANT_ID>

Example:

curl -X GET \
  -H "Authorization: Bearer <YOUR_JWT>" \
  -H "X-Tenant-Id: <YOUR_TENANT_ID>" \
  https://crm.dreamhub.ai/api/v1/endpoint

With PAT

Headers:

Authorization: Bearer pat_<YOUR_PAT>

Example:

curl -X GET \
  -H "Authorization: Bearer pat_<YOUR_PAT>" \
  https://crm.dreamhub.ai/api/v1/endpoint

Notes:

• PAT tokens always begin with pat_ and do not require X-Tenant-Id.
• JWT requests must include a correct X-Tenant-Id or they will be rejected.

Choosing A Method

• Use JWT if your organization issues short-lived access tokens and you use client-side code.
• Use PAT if you use a server-based tool.

Managing Personal Access Tokens

You can manage tokens from Settings → API Keys or through the API. You can call every endpoint below with either authentication method: a Bearer JWT with X-Tenant-Id, or an existing PAT.

Base URL: https://crm.dreamhub.ai/api/v1/accessenabler/tokens

Generate or rotate a token

From the UI: Settings → API Keys → Generate Key, or Regenerate Key if a key already exists.

From the API:

curl -X POST https://crm.dreamhub.ai/api/v1/accessenabler/tokens/ \
  -H "Authorization: Bearer $DREAMHUB_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"name": "nightly-export", "expiresInDays": 90}'

Response (201):

{
  "id": "…",
  "name": "nightly-export",
  "token": "pat_…",
  "createdAt": "2026-10-16T09:00:00Z",
  "expiresAt": "2027-01-14T09:00:00Z"
}

The token value is returned only once. Store it immediately.

Request fields:

• name (string, up to 256 characters): identifies the token. Generating a token replaces your existing tokens with the same name. The settings-page key is named webapp-pat. Give an integration a name of its own, such as nightly-export, so regenerating on the settings page doesn't revoke it. If you leave name out, the token is unnamed, and unnamed tokens replace each other.
• expiresInDays (integer, 1–365): defaults to 365 if omitted. Expiry can't be disabled: null, 0 or values above 365 return 422.

Rotation has no overlap. The previous token with the same name stops working as soon as the new one is created. Switch your callers to the new value right after the call returns. Don't revoke first and then generate: generating already revokes the old token, and revoking first leaves you with no valid token in between.

Permissions are a snapshot. A token keeps the permissions its user had when it was generated. A script can rotate its own token by authenticating with its current PAT, but the new token then inherits the old token's permissions. To pick up the user's current role, rotate with a JWT (sign in, or use the settings page).

Check the settings-page token

curl https://crm.dreamhub.ai/api/v1/accessenabler/tokens/me \
  -H "Authorization: Bearer $DREAMHUB_TOKEN"

{
  "hasToken": true,
  "token": {
    "id": "…",
    "name": "webapp-pat",
    "createdAt": "…",
    "expiresAt": "…",
    "lastUsedAt": "…"
  }
}

This endpoint reports only the webapp-pat token. Use GET / to see tokens under other names. lastUsedAt is approximate, because it updates at most every 15 minutes. Tokens are never rotated automatically, so plan a rotation before expiresAt.

List tokens

curl "https://crm.dreamhub.ai/api/v1/accessenabler/tokens/?page=1&pageSize=20" \
  -H "Authorization: Bearer $DREAMHUB_TOKEN"

{
  "tokens": [
    { "id": "…", "name": "nightly-export", "createdAt": "…", "expiresAt": "…", "lastUsedAt": null }
  ],
  "total": 1,
  "page": 1,
  "pageSize": 20
}

The response lists your active tokens under every name, newest first. Token values are never returned. pageSize can be 1–100 and defaults to 20.

Revoke a token

curl -X DELETE "https://crm.dreamhub.ai/api/v1/accessenabler/tokens/$TOKEN_ID" \
  -H "Authorization: Bearer $DREAMHUB_TOKEN"

Returns {"deleted": true}, or 404 if the token doesn't exist or isn't yours.

Tokens for integrations

A token acts as the user who generated it. For a server-side integration, generate the token as a dedicated user that has only the role the integration needs. A personal token keeps its original permissions after that person changes role or leaves, until it expires or is revoked.

Renaming creates a new token instead of rotating the old one. If you generate export-v1 and later export-v2, export-v1 stays valid until you revoke it.

If a token is exposed

Whoever holds a token can use it to generate more tokens under other names, and those survive revoking the original. On a suspected leak, list your tokens with GET / and revoke every one of them, then generate fresh ones and contact support@dreamhub.ai.

Error Guide

401 Unauthorized:

• Missing Authorization header
• Invalid or expired token
• For PAT: the token was replaced by a newer token with the same name, or revoked
• For JWT: missing or incorrect X-Tenant-Id

403 Forbidden:

• You are authenticated but lack the required permissions for the endpoint

Best Practices

• Always use HTTPS and send the Authorization header on every request.
• Do not share or hard-code tokens. Rotate them regularly, and before they expire.
• Avoid logging full tokens; redact them if you log requests.

Troubleshooting

• Verify the header format: Authorization: Bearer <token>
• For PAT: ensure the token starts with pat_
• For JWT: confirm X-Tenant-Id exactly matches your tenant ID
• Check that your token is current (not expired or replaced) and that you're calling the correct API base URL

Still stuck? Contact support@dreamhub.ai with the timestamp, endpoint, and response status code (do not include your token).