Authentication Methods

Authentication Methods

DMARC Busta supports multiple authentication methods depending on your use case.

1. Bearer Token (API)

For programmatic access to the API.

curl -H "Authorization: Bearer YOUR_TOKEN" \
  https://app.dmarcbusta.com/api/v1/domains

• Create tokens in Settings → API Access
• Each token is scoped to the creating user's account
• Store securely — never commit to repositories
• Revoke unused tokens anytime

2. Session-Based (Web)

Browser-based authentication for the web dashboard.

• Login with email/password, Google, Azure, or LinkedIn
• Session stored in secure HTTP-only cookies
• CSRF protection enabled
• Automatic logout after 30 days of inactivity

3. Embed Key (Widgets)

For third-party embedded scanners and widgets.

// Embed endpoint
GET /api/embed/{embed_key}/scan

• Public-key authentication (no secret required)
• CORS validation on origin domain
• Used for whitelabel widgets

4. Alert Webhooks (outbound)

Requests we send to your webhook URL are not signed yet.

• Keep the webhook URL secret and include an unguessable token in it
• Confirm an alert with GET /api/v1/alerts/{id} before acting on it
• HMAC-signed payloads are planned; see Alert Webhooks

5. OAuth (Social Login)

Supported providers for account authentication:

• Google OAuth 2.0
• Microsoft Azure AD
• LinkedIn OAuth