Authentication

Bidyear uses Laravel Sanctum personal access tokens with ability scopes. Tokens are created in the app UI and sent as a Bearer token on every authenticated request.

Obtaining a token

Log in to your Bidyear account.
Go to Account → API Tokens.
Enter a token name and select the abilities you need (see table below).
Click Create — copy the token immediately, it is shown only once.

Token abilities

Each token is created with one or more abilities. Routes enforce the minimum required ability via the EnsureTokenAbility middleware.

Ability	Access granted	Who needs it
`read`	Own invoices, profile (`/v1/me`, `/v1/invoices`)	Any authenticated user reading their own data
`write`	Place bids, manage watchlist, reorder/delete media	Bidders, sellers uploading content
`seller`	Ad campaigns, webhook subscriptions, current subscription	Sellers and agency team members
`admin`	Reserved for platform administrators	Platform ops only

Session-authenticated SPA users (browser sessions) bypass token ability checks on media endpoints — they may reorder/delete without a token.

Sending the token

Authorization: Bearer {your-api-token}
Accept: application/json

Example

curl -X GET "https://bidyear.com/api/v1/me" \
  -H "Authorization: Bearer 1|abc123xyz..." \
  -H "Accept: application/json"

Multi-team sellers — X-Team-Id header

Seller accounts often manage multiple auction teams. For seller-scoped endpoints (seller ability), pass the team you want to act as:

X-Team-Id: 42

The ResolveApiTeam middleware reads this header and switches the authenticated user's active team for the duration of the request. Omit it to use your personal (default) team.

GET /api/user Auth required

Returns the authenticated user. Compatible with Jetstream SPA defaults. See Me / Profile for the full v1 resource format at /api/v1/me.

Response 200

{
  "id": 42,
  "name": "Jane Doe",
  "email": "jane@example.com",
  "email_verified_at": "2026-06-01T10:00:00.000000Z"
}

Public endpoints (no token required)

All GET /api/v1/* endpoints for auctions, lots, bids, categories, subscription plans, cross-listing platforms, and help center are publicly readable without a token.

Token error responses

HTTP	Code	Meaning
401	`unauthenticated`	No token or expired token
403	`insufficient_token_ability`	Token exists but lacks the required ability — recreate with the correct abilities