Authentication
The public catalogue API needs no authentication. The creator API uses bearer tokens.
curl https://scriptbunker.com/api/v1/creator/me \
-H "Authorization: Bearer sbt_AbCd1234_…"
Token format and storage
A token looks like sbt_<8 characters>_<43 characters> and carries 256 bits of randomness. ScriptBunker shows it exactly once, when you create it. Only a keyed HMAC-SHA256 digest and the short public prefix are stored, so a token cannot be recovered later — not by you and not by ScriptBunker. If you lose one, revoke it and create another.
The dashboard lists a token's name, scopes, masked prefix (sbt_AbCd1234_••••••••), creation date, last use and expiry.
Scopes
A token has an explicit list of scopes. There is no "full access" token and no default scope.
| Scope | Allows |
|---|---|
projects:read | List your projects and read their metadata and distribution status |
scripts:read | Read the hosted source files of your own releases |
releases:read | List releases and changelogs (no source) |
releases:write | Publish new releases |
analytics:read | Read a project's creator analytics |
keys:read | List ScriptBunker Keys as masked values with state and dates |
keys:write | Generate keys, revoke keys, reset a key's device binding |
webhooks:manage | Create, edit, rotate, test and delete your webhooks |
No scope grants account authentication operations. Creating or revoking tokens is only possible from the signed-in dashboard, never with a token.
Checks on every request
- The token exists, is not revoked and has not expired — otherwise
401 invalid_token. An unknown, malformed, revoked and expired token all give the same answer. - It has the scope the endpoint needs — otherwise
403 insufficient_scope. - For write scopes, your creator account is active — otherwise
403 account_suspended. - The resource belongs to your creator account. Another creator's project, release, key or webhook is reported as
404 not_found, the same as one that does not exist.
Tips
- Give each integration its own token and only the scopes it needs, so you can revoke one without touching the rest.
- Set an expiry for tokens used in CI.
- Treat a token like a password: keep it in your CI secret store, never in a repository or a Roblox script.