Get a page-token
While signed in, open the user menu in the top-right corner and choose
“Mint page-token”. Give it a name, generate it, and copy the value — it starts
with dspt_ and is shown once. It is scoped to your own role and expires in
30 days. Keep it secret; treat it like a password.
Send the token as a Bearer header
Put the token in the Authorization header on every request. This is the only scheme
that works for both gated pages and the API:
| Scheme | Gated pages (HTML) | /api/* (JSON) |
|---|---|---|
| Authorization: Bearer dspt_… | Yes | Yes |
| X-Page-Token: dspt_… | Yes | Yes |
| X-API-Key: dspt_… | No | Yes |
| ?api_key=dspt_… | No | Yes |
Authorization: Bearer <token> everywhere. The
X-API-Key / ?api_key= forms only reach the API — they do not
unlock pages.
Fetch a gated page
Request the real page URL. There is no separate API path and no ?format=json — you get back the
exact HTML a logged-in browser would see. Replace <path> with any page your role can access:
# returns 200 + the page HTML on success
curl -sS -H "Authorization: Bearer dspt_YOUR_TOKEN" \
https://www.danscodellaro.com/<path>/
Because a rejected request redirects instead of erroring, don’t blindly follow redirects.
Check the status code — 200 is content, a 302 to /login.html means the
token was not accepted:
curl -s -o body.html -w '%{http_code} %{redirect_url}\n' \
-H "Authorization: Bearer dspt_YOUR_TOKEN" \
https://www.danscodellaro.com/<path>/
# 200 -> body.html is the page
# 302 .../login.html -> token rejected (expired / wrong / no access)Call the JSON API
Same header, any /api/* endpoint. A quick way to confirm your token works is the
“who am I” endpoint — it echoes back the authenticated user as JSON:
curl -sS -H "Authorization: Bearer dspt_YOUR_TOKEN" \
https://www.danscodellaro.com/api/auth/mePaste this into your agent
A self-contained instruction block you can hand to an AI agent verbatim. Swap in the token and target path.
# Accessing danscodellaro.com from the command line
You have a PAGE-TOKEN (it starts with `dspt_`). Use it to reach pages and API
endpoints that normally require a browser login.
AUTH — send the token as a Bearer header on EVERY request:
Authorization: Bearer dspt_YOUR_TOKEN
RULES
- Always use HTTPS against https://www.danscodellaro.com (never plain HTTP or a bare IP).
- 200 = success. A 302 redirect to /login.html means the token was rejected
(expired, wrong, or your role lacks access to that page). Treat a login
redirect as an auth failure — do NOT follow it and parse the login page as data.
- The token is scoped to your role and expires 30 days after issue. When it stops
working, mint or rotate a new one from the site's user menu ("Mint page-token").
- Keep the token secret. Do not log it or commit it.
FETCH A GATED PAGE (returns that page's HTML):
curl -sS -H "Authorization: Bearer dspt_YOUR_TOKEN" \
https://www.danscodellaro.com/<path>/
CALL A JSON API (example: the authenticated-user endpoint):
curl -sS -H "Authorization: Bearer dspt_YOUR_TOKEN" \
https://www.danscodellaro.com/api/auth/me
CHECK THE STATUS CODE instead of trusting the body:
curl -s -o out -w '%{http_code}\n' \
-H "Authorization: Bearer dspt_YOUR_TOKEN" URL