Authorization
header:
401:
Scopes
A token carries one or more scopes. A request that needs a scope the token lacks returns403
forbidden_scope.
Ask your Torii operator for a token with the scopes you need. Tokens are revocable — a revoked
token immediately returns
401.Public endpoints (no token)
Three routes are intentionally un-gated so a browser element can load them without a bearer it cannot send:GET /v1/health
Liveness + light fleet stats.
GET /v1/media
The image/video proxy — an
<img> or <video> points straight at it.GET /v1/preview
The hover-to-play preview clip — a
<video> points straight at it.POST /v1/preview/warm
(a server-to-server render trigger) does require a token.