generated: '2026-07-18'
method: searched
source: https://docs.ascend.io/getting-started/quickstart + https://github.com/ascend-io/ascend-tools (AGENTS.md, crates/ascend-tools-core/src/auth.rs)
docs: https://docs.ascend.io
summary:
  types: [http-bearer, service-account]
  api_key_in: []
  token_exchange: true
model: >-
  The Ascend Instance web API uses service-account authentication. A service account (id
  prefix `asc-sa-...`) is created in the Ascend UI (Settings > Users > Create Service Account)
  and issued an Ed25519 private key (base64url, shown once at creation). The SDK/CLI signs an
  Ed25519 JWT assertion and exchanges it via the Cloud API token-exchange flow for a short-lived
  Bearer token, which is cached and attached as `Authorization: Bearer <token>` on every
  `/api/v1/*` request (except `/api/v1/auth/*`).
schemes:
  - name: serviceAccountBearer
    type: http
    scheme: bearer
    credential: Ed25519 service account key (asc-sa-...)
    header: 'Authorization: Bearer <token>'
    token_endpoint_family: /api/v1/auth/*
    note: Token obtained via Ed25519 JWT assertion -> Cloud API token exchange; cached with refresh mutex.
credentials:
  env:
    - name: ASCEND_SERVICE_ACCOUNT_ID
      description: Service account ID (asc-sa-...)
    - name: ASCEND_SERVICE_ACCOUNT_KEY
      description: Ed25519 private key (base64url, shown once at creation)
    - name: ASCEND_INSTANCE_API_URL
      description: Instance API URL (e.g. https://api.instance.ascend.io)
  config_file: ~/.ascend-tools/config.toml
  resolution_order: [cli-flags, instance-config-toml, env-vars]