Authentication

Placeholder: Replace this page with the authentication requirements for your API before publishing it.

Overview

All API requests require an access token. Create a token in the [placeholder: Developer Portal], then send it with every request using the Authorization header.

Caution

Never put API tokens in browser code, mobile apps, or source control. Store them in an environment variable or another secure secret store instead.

Send an access token

Include your token as a Bearer token:

curl 'https://api.example.com/v1/example-resource' \
  --header 'Authorization: Bearer YOUR_ACCESS_TOKEN'

Authorization: Bearer YOUR_ACCESS_TOKEN

Replace YOUR_ACCESS_TOKEN with a token issued for your integration.

Token permissions

Tokens should use the minimum permissions required by the integration.

Placeholder scope	Allows
example:read	Read example resources.
example:write	Create and update example resources.
webhooks:manage	Create, rotate, and delete webhook subscriptions.

Authentication errors

Status	Meaning	What to do
401 Unauthorized	The token is missing, invalid, or expired.	Check the header and obtain a new token.
403 Forbidden	The token is valid but lacks a required permission.	Request the required scope.
429 Too Many Requests	The request limit was reached.	Wait and retry using the response headers.

Next steps

• Learn how to use the [placeholder: token management endpoint].
• Configure [placeholder: webhook signing] for inbound events.
• Review the API-specific authentication requirements in each reference section.