Authentication

Open in the interactive reference

Authenticate every request with an access token, sent as a bearer token in the Authorization header. Access tokens explains how to create one and grant it access.

Two statuses report a problem with the token:

• 401: the request carries no valid access token, for example because the token is missing, expired or revoked.
• 403: the token is valid but has not been granted this endpoint.

Neither response carries an error code, so branch on the status. The body of a 401 also differs from every other failure: its error is a string, not an object.

Webhook deliveries work the other way round: the platform signs them, and your endpoint verifies the signature. See Webhooks.

Examples

A refused token

HTTP/1.1 401 Unauthorized

{ "error": "401 Unauthorized - …" }