Docs · v1.4

Build with Scovant.

Run scans, simulations, and showcase from the dashboard — or drive it all from your pipeline: the REST API, CI/CD trigger, webhooks, and the MCP interface are live today. Entries marked “Soon” are on the roadmap.

Quickstart · 3 of 8

Authentication.

Scovant supports two authentication methods:

OAuth (dashboard login) Sign in with Google or GitHub at /login. OAuth identities are auto-linked to existing accounts by verified email address.

API tokens (programmatic access) Create API tokens in Settings → API tokens (workspace owner only). Tokens use the format scvt_ followed by 43 URL-safe characters and are shown once on creation. Each workspace holds one active token at a time — creating a second returns 409 {"error": "token_already_exists"}; revoke the current token first. Use them as Bearer tokens:

Authorization: Bearer scvt_...

API tokens authenticate programmatic scan triggers (POST /api/scans), simulation launches (POST /api/simulations), and the CI trigger endpoint (POST /api/ci/trigger). The authenticated tools on the MCP interface accept the same bearer token — that is the token's read path for scan results, regressions, simulations, and Fix Plans. A token is scoped to the workspace it was created in: it can only act on that workspace's sites.