Getting Started

Create one scoped integration API key, send it as a bearer credential, and make your first request.

INFO

One authentication standard

Server-to-server integrations authenticate with an API key in the Authorization header.

Make your first request

Create an API key

In your community, open Settings > Integration > API Keys. An administrator creates the key.

Choose permissions

Grant only the permissions required by the endpoints your integration will call, then set an appropriate expiration.

Send the key

Include Authorization: Bearer YOUR_API_KEY with every authenticated request.

A successful call returns the response documented on that endpoint's page. Replace YOUR_API_KEY with the key you created.

Principle	What to do
Community scope	Use a key created for the community the integration should access.
Least privilege	Grant only the permissions named on the endpoints you call.
Expiration	Set an expiration that matches the integration's operating window.
Secret storage	Keep the key in server-side secret storage. Never ship it in browser code or commit it to a repository.
Rotation	Create and test a replacement key before revoking the old key.

WARNING

Store the generated key securely

Treat the key as a password. Do not paste it into tickets, chat messages, screenshots, browser code, or public repositories.

HTTP	Meaning	What to do
`401`	The credential is missing, malformed, invalid, or expired.	Add, replace, or rotate the API key.
`403`	The credential is valid but lacks the required permission.	Add the permission documented on the endpoint or use the correct key.

Manage API keys

Create a key with the permissions and expiration your integration needs.

Create your first user

Make the first broker onboarding request with your new key.