Authentication

The Space API uses token-based authentication to control access to floor plans and related resources. Different token types are available depending on your use case:

• Publishable tokens for public resources in frontend applications
• Secret tokens for backend integrations with full API access
• Temporary tokens for secure frontend access to private resources
• OAuth 2.0 tokens for standardized authorization flows

Scopes

Space API V2 supports the following scopes:

Scope	Description
floor:readPublic	Read public floor resources
floor:readPrivate	Read private floor resources
floor:queryPublic	List and read public floor resources
floor:queryPrivate	List and read private floor resources
floor:update	Update floor or layout
floor:export	Export floor
floor:archive	Archive floors
customAttributes:read	Read custom attribute definitions
customAttributes:write	Create/Update/Delete custom attributes definitions
customAttributeValues:readPublic	Read custom attributes values of public floors
customAttributeValues:readPrivate	Read custom attributes values of private floors
customAttributeValues:write	Create/Update/Delete custom attributes values
extension:create	Create extensions
extension:update	Update extensions
extension:query	Query extensions
extension:delete	Delete extensions
webhook:read	Read webhooks
webhook:create	Create webhooks
webhook:query	Query webhooks
webhook:update	Update webhooks
webhook:delete	Delete webhooks

Publishable Access Token

Publishable tokens restrict which domains can display public floors. Safe to expose in frontend code.

Scopes

Publishable access tokens support only the following scopes:

• floor:readPublic
• floor:queryPublic
• customAttributes:read
• customAttributeValues:readPublic

Generate

Generate on the access tokens page (100 token limit).

Usage

Supply in the pubtoken query parameter:

# You need to supply a domain allowed for this token as origin to simulate a browser environment
curl -H "Origin: ${ORIGIN}" \
  "https://api.archilogic.com/v2/floor/${FLOOR_ID}?pubtoken=${PUBLISHABLE_TOKEN}"

INFO

Publishable tokens for the 3D Embed API should allow the viewer.archilogic.com domain.

Secret Access Token

Secret tokens provide full API access with all scopes. Use only in backend applications and keep secure.

Generate

Generate on the access tokens page (100 token limit).

Usage

Supply in the Authorization header as a Bearer token:

curl -H "Authorization: Bearer ${SECRET_TOKEN}" \
  "https://api.archilogic.com/v2/floor/${FLOOR_ID}"

Temporary Access Token

Generate short-lived tokens server-side for secure frontend access to private resources without exposing secret tokens.

Your backend requests a temporary token using your secret token, then provides this temporary token to your frontend for secure API access.

Generate

Create temporary tokens using your secret token.

Method:

POST

https://api.archilogic.com/v2/temporary-access-token/create

Parameters:

JSON object in the body of the request with the following properties:

• scopes {ScopeDefinition[]} - Array of scope definitions (must be subset of secret token's scopes)

type ResourceScope = 'floor' | 'webhook'

type ActionScope =
  | 'archive'
  | 'create'
  | 'delete'
  | 'export'
  | 'queryPublic'
  | 'queryPrivate'
  | 'query'
  | 'readPrivate'
  | 'readPublic'
  | 'read'
  | 'update'

interface ScopeDefinition {
  resource: ResourceScope
  action: ActionScope
}

• durationSeconds {number} - Token validity in seconds (15 min - 1 day, default: 1 hour)

Returns:

JSON with the following properties:

• authorization {string} - Bearer token for Authorization header
• expiresAt {number} - Unix timestamp when token expires

Example API call:

curl -X POST \
  -H "Authorization: Bearer ${SECRET_TOKEN}" \
  -H "Content-Type: application/json" \
  -d '{"scopes": [{"resource": "floor", "action": "readPrivate"}], "durationSeconds": 3600}' \
  "https://api.archilogic.com/v2/temporary-access-token/create"

Example response:

{
  "authorization": "Bearer XlqHBdUIOF46ah...",
  "expiresAt": 1616079083
}

Usage

Supply in the Authorization header as a Bearer token:

curl -H "Authorization: Bearer ${TEMPORARY_TOKEN}" \
  "https://api.archilogic.com/v2/floor/${FLOOR_ID}"

Example App

Access Private Models with the Floor plan engine and Temporary Access Tokens

OAuth 2.0 Access Tokens

OAuth 2.0 tokens provide the same capabilities as secret tokens through standardized authorization flows.

See the OAuth 2.0 guide for implementation details.