Web Tokens

The MASV API uses JSON Web Token (JWT) to authorize package and transfer operations. These requests must have the appropriate header field:

• X-Package-Token: For accessing a package. Examples: uploads and downloads.
• X-Transfer-Token: For accessing a transfer to and from a cloud connection.

Danger

Do not use X-User-Token for API integrations. User tokens require storing passwords, bypass MFA, and expose your full account privileges. Use API keys instead — they are scoped, rotatable, and do not require credential storage.

Package tokens

The MASV API requires special JWTs to interact with packages. These tokens are authorized to interact with a single package, rather than all packages.

Package tokens come in one of three variants, depending on the authentication mechanism used to request them:

• Write access (limited): Granted by the initial create Portal package request. Restricted to actions needed to complete the upload — creating files and finalizing the package — without the ability to create links, edit the package expiry, or initiate transfers to connected storage.
• Read access (limited): Granted by authenticating with link credentials. Used primarily for downloading package files. Limited to reading package details, though it does allow clients to initiate transfers to cloud storage when providing single-use credentials.
• Management access: Granted when authenticating with user credentials (API key) for managing packages owned by the account. Returned when fetching the list of packages or when sending a package. Permits editing package details (name, expiry), creating additional links, deleting the package, and viewing or initiating transfers to connected storage integrations. Does not directly permit downloads — a link must be created and authenticated to get a read access token.

For endpoints that require it, your request must have the X-Package-Token header set:

Name	Type	Required	Description
X-Package-Token	String	Yes	access_token from a package response

Transfer tokens

The MASV API requires special JWTs to interact with transfers to connected storage. These tokens are authorized to interact with an individual transfer and are limited to reading the transfer status, retrying it, or cancelling it. Transfer tokens are returned when initiating a new transfer or when fetching the list of transfers for a specific package.

For endpoints that require it, your request must have the X-Transfer-Token header set:

Name	Type	Required	Description
X-Transfer-Token	String	Yes	access_token from a transfer response