Authentication

Every /v1 request needs an Authorization: Bearer YOUR_TOKEN header.

Getting a token

Tokens are minted per-guild from that guild's Developer API page on the WabbitBot dashboard (requires the guild owner and an active premium subscription — access to /v1 is gated by the guild's premium status and is automatically suspended if premium lapses, then restored if it's regained).

A token is bound to the guild it was minted for at creation time — it cannot be used against any other guild, and routes never take a guild identifier as a parameter.

Scopes

Every token carries one or both scopes:

• read — required by every GET/HEAD route

• write — required by every other route (POST, PATCH, etc.)

  A request with a token missing the required scope gets a 403 with error.code: "INSUFFICIENT_SCOPE".

Token lifecycle

• Revoke a token from the same dashboard page at any time. A revoked token's requests fail with 403 / TOKEN_REVOKED.
• If the guild's premium subscription lapses, its tokens are automatically disabled (402 / SUBSCRIPTION_INACTIVE) until premium is restored.
• Every request against a token is logged (guild owners can view this activity log on the same dashboard page) — timestamp, route, method, and response status.