User Authentication

Authenticate as a user to perform ad-hoc queries or engineer-level tasks. This method requires a username (email) and password.

Not for Automation This method requires a specific user’s credentials and is not recommended for CI/CD pipelines. For automated integration, use M2M Authentication.

SSO Not Supported This authentication method does not work with SSO (SAML, OIDC federation). Users must have a dedicated username and password configured directly in Keycloak.

Access control

The token has the same permissions as the user who requested it. The API applies the user’s roles the same way the dashboard does, so a Product Viewer can read findings but can’t upload or scan images. List endpoints return only the resources the user can access. To give a script access to specific products only, create a dedicated BTP user, assign it only the roles the script needs, and authenticate as that user. M2M tokens can’t be restricted this way. See Authentication Methods for a comparison.

Password Grant Flow

Use this flow for interactive access where you can securely provide your user credentials.

Request

# 1. Set your credentials
export BINARLY_EMAIL="your-email@example.com"
export BINARLY_PASSWORD="your-password"
# Replace {slug} with your organization's tenant identifier
export BINARLY_AUTH_URL="https://auth-{slug}.binarly.cloud/realms/BinarlyRealm/protocol/openid-connect/token"

# 2. Request the token
curl -sS --fail-with-body -H "Content-Type: application/x-www-form-urlencoded" \
  --data-urlencode "grant_type=password" \
  --data-urlencode "scope=openid" \
  --data-urlencode "client_id=BinarlyClient" \
  --data-urlencode "username=${BINARLY_EMAIL}" \
  --data-urlencode "password=${BINARLY_PASSWORD}" \
  "${BINARLY_AUTH_URL}"

Response

The response contains the access_token needed for API requests.

{
  "access_token": "eyJhbGciOiJSUzI1NiIs...",
  "token_type": "Bearer",
  "expires_in": 1800
}

Next Steps

Include this token in the Authorization header of your API requests: Authorization: Bearer <access_token> The examples on the API reference pages read the token from TOKEN and your dashboard URL from BINARLY_API_URL. Set both before you run them:

TOKEN=$(curl -sS --fail-with-body -H "Content-Type: application/x-www-form-urlencoded" \
  --data-urlencode "grant_type=password" \
  --data-urlencode "scope=openid" \
  --data-urlencode "client_id=BinarlyClient" \
  --data-urlencode "username=${BINARLY_EMAIL}" \
  --data-urlencode "password=${BINARLY_PASSWORD}" \
  "${BINARLY_AUTH_URL}" | jq -r '.access_token')

# Replace {slug} with your organization's tenant identifier. Endpoint paths add /api/v4.
export BINARLY_API_URL="https://dashboard-{slug}.binarly.cloud"

Overview

Use Cases

Reference

Access control

Password Grant Flow

Request

Response

Next Steps