Authentication

DialRight uses organization API tokens (JWTs). Session cookies from the web app are not accepted on scan routes.

Authorization: Bearer <organization-api-token>

Create a token

Create your first token in the DialRight web app: sign in as an organization Administrator, open the API tokens page, and create a token with a role that is allowed to scan. The value is shown once.

After that you can also call POST /v1/org/apiTokens with a name, role, and a future expiresAt Unix timestamp. That route requires the Administrator role, so the calling token must itself have been created with the Administrator role.

If you omit expiresAt today, runtime can mint a JWT that expires immediately. Pass a future Unix timestamp until that backend behavior is fixed.

Do not send a Caller ID Reputation Enterprise API token. Those are rejected by dialright-api.calleridreputation.com.

Rotate and revoke

List tokens with GET /v1/org/apiTokens. Toggle or delete a token by tokenId when you rotate credentials.

Treat tokens as secrets. Do not log them or paste them into tickets, chats, or AI tools.