Installation tokens

An installation token is the simplest way to authenticate. It’s the token shown once when you issue a credential, and it starts with igw_live_ or igw_test_.

curl -s https://api.inside.chat/api/v1/context \
  -H "Authorization: Bearer $INSIDE_GATEWAY_TOKEN"

The same token works for REST, the Business MCP server and A2A.

Lifetime

The token works until its credential expires, is rotated or is revoked. Because it’s long-lived:

• Give the credential a short expiry and rotate it regularly.
• Narrow its scopes and websites to what the integration needs.
• Keep it in a secret manager or environment variable.

Environment	Token prefix
Production	igw_live_
Development	igw_test_

Prefer short-lived tokens on shared machines

If the token is stored somewhere many people or processes can read, exchange it for a 15-minute token with OAuth client credentials instead. The short-lived token is also bound to a single interface.

When access changes

Every request rechecks the credential, installation, application, organization, website grant and data policy. Revoking, rotating, suspending or narrowing access takes effect on the next request.