Torii authenticates every request with a bearer API token. Send it in the Authorization header:
A missing or invalid token returns 401:

Scopes

A token carries one or more scopes. A request that needs a scope the token lacks returns 403 forbidden_scope.
Ask your Torii operator for a token with the scopes you need. Tokens are revocable — a revoked token immediately returns 401.

Public endpoints (no token)

Three routes are intentionally un-gated so a browser element can load them without a bearer it cannot send:

GET /v1/health

Liveness + light fleet stats.

GET /v1/media

The image/video proxy — an <img> or <video> points straight at it.

GET /v1/preview

The hover-to-play preview clip — a <video> points straight at it.
These are SSRF-allowlisted to known CDN hosts and serve no account data. POST /v1/preview/warm (a server-to-server render trigger) does require a token.

Example