Authentication — Organizer API Token (Org / Event Scoped, Not User)

All Event, Attendee, and /mcp endpoints authenticate with an organizer API token — not a user JWT.

Token Format

Send the token on every request as:

Authorization: Bearer evtx_live_<secret>

• Secret shape: evtx_live_ (10-char prefix) followed by a 43-char base64url secret (32 random bytes) — e.g. evtx_live_9k3…cB1.

• x-api-key: evtx_live_… is also accepted as an alternative header.

• The token must begin with the evtx_ prefix or it is rejected with 401.

Provisioning

Tokens are created in the Organiser Portal → API Tokens (portalRoutes.userPortalApiTokens).

The raw secret is shown only once at creation. Subsequent reads return only prefix and last4 for display.

Scope

• scope='org' → token.organization_id === event.organization_id; grants access to all events in the organization.

• scope='event' → token.event_id === eventId; grants access to only that single event. An event-scoped token cannot call the org-only GET /v2/events list endpoint.

Scope enforcement is pure token-level — it never consults userId, user_org_assignment, or attendee roleTags (event-auth.ts is bypassed for these routes).

Permissions

• read → GET requests only.

• write → implies read; allows POST / PUT / PATCH / DELETE (checked via isWriteMethod).

Validation & Errors

A token is rejected when is_enabled=false, deleted_at is set, or expires_at is in the past. Failure modes:

• 401 ERR_PUBLIC_API_UNAUTHORIZED — missing, malformed, expired, or revoked token.

• 403 ERR_PUBLIC_API_FORBIDDEN — token valid but wrong org/event scope, or read-only token used on a write method.

Legacy POST /auth JWT exchange (user:{userId}:{secret} → Bearer JWT 1h) remains for backward compat on tickets/addons, but Event/Attendee prefer direct organizer_api_token Bearer.