Authentication
- Authorization: ApiKey
- The API key is sent exclusively in the Authorization header of POST /api/v1/auth/token. Do not put it in JSON, a URL or query parameters.
- Authorization: Bearer
- Use the returned token for resource requests and renew it according to expires_at; expires_in is expressed in seconds.
Why get a token first?
Use your API key to obtain a token. The token lasts 15 minutes and can be used for multiple requests. Send only the token to resources in the Authorization: Bearer header.
Ordinary requests do not contain your API key. A leaked token can only grant access until it expires. A stolen API key may still allow someone to obtain new tokens.
How long does a token last?
- expires_in
- 900 seconds, or 15 minutes from issuance. Making requests does not extend its lifetime.
- expires_at
- Expiration time in UTC. Current access restrictions can block the token earlier.
When should I get another token?
Reuse the same token for multiple requests and obtain another before expires_at. Do not request a token before every operation. Use your API key to obtain the new token.
Access denied and retries
- 401
- 401 does not always mean the token has expired. If it has expired, obtain a new token and retry the read at most once. If obtaining a token returns 401, check the key and stop automatic attempts.
- 403
- For 403, check permissions, IP restrictions and the plan. Obtaining a new token does not restore revoked access.
IP restrictions
- An access token does not bypass current key permissions, store entitlements, revocation or IP restrictions.
- Restrict a key to the integration's source addresses when appropriate.
- The administrator can edit this list; at most 32 addresses are accepted.
Key administration
- API key management is separate from an integration's resource permissions.
- Only owner can grant groups the administrative permissions to view, create, edit or delete keys; an authorized group member can perform only the actions granted to that group.
Rate limits
Engine ≥ 4.143.0. Each token response includes data.rate_limits from the store policy at issuance. All keys share these budgets; a new token does not reset them. A plan change may apply before the token expires.
- read_per_minute
- Read requests per minute.
- write_per_minute
- Write requests per minute; this value does not grant write permissions.
- auth_per_minute
- Token requests per minute, including failed authentication attempts.