Authentication & tokens
The four token types and how scopes work.
TraceGuard issues bearer tokens with a typed prefix so you can tell at a glance what a token is for:
| Type | Prefix | Use it for |
|---|---|---|
| Personal access token | tgp_ | Acting as yourself from scripts or the CLI. |
| Service account token | tgs_ | Automation owned by a service account. |
| Deploy token | tgd_ | CI uploads, scoped to a single project. |
| MCP token | tgm_ | Connecting an MCP client (Claude, an IDE). |
Send a token as a bearer header:
curl -H "Authorization: Bearer tgd_xxxxxxxx" \
"https://app.traceguard.io/api/v1/organizations/$ORG/projects/$PROJECT/sboms"Scopes
A token's authority is a set of scopes — the same resource:action
permission IDs used by roles. Scopes
support wildcards:
*— every permission the granter has.sboms:*— every action on a resource.*:read— a verb across resources.
Scopes are always intersected with the authority of whoever created the token, and enforced again at the database boundary. A token can never do more than its creator could — and never read or write across organization boundaries.
Tokens are shown once at creation. Store them in a secrets manager, scope them to the minimum they need, and rotate them if exposed. Never commit a token to source control.