---
title: 'API Reference'
description: 'Pocketenv XRPC API — manage sandboxes, files, secrets, services, and more.'
---

## Base URL

All API requests are made to:

```
https://api.pocketenv.io/xrpc/
```

## Authentication

Every endpoint requires a Bearer token in the `Authorization` header.

```bash
Authorization: Bearer <your-token>
```

<Note>
  You can retrieve a token via the Pocketenv dashboard or by authenticating through the [AT Protocol](https://atproto.com) flow.
</Note>

## Errors

All errors return a JSON body with `error` and `message` fields.

| Status | Meaning |
|--------|---------|
| `400`  | Bad request — invalid parameters or missing fields |
| `401`  | Unauthorized — missing or invalid Bearer token |

```json
{
  "error": "InvalidRequest",
  "message": "Missing required field: sandboxId"
}
```

## Resources

| Resource | Description |
|----------|-------------|
| **Actor** | User profile and account-level sandbox access |
| **Sandboxes** | Full sandbox lifecycle — create, start, stop, exec, delete |
| **Files** | Read and write files inside a sandbox |
| **Secrets** | Encrypted key-value secrets scoped to a sandbox |
| **Variables** | Environment variables for sandbox configuration |
| **Services** | Long-running processes inside a sandbox |
| **Volumes** | Persistent storage volumes attached to sandboxes |