Authentication

Send your token in the Authorization header as a bearer token, on every request:

Authorization: Bearer YOUR_TOKEN

It's one token for your whole integration — there's no login step and no per-user credentials.

Keep it secret

Anyone with your token can make requests on your behalf, and they count against your plan.

• Call the API from your server, not from a browser or mobile app, where anyone can read the token.
• Keep the token in an environment variable, not in your code or repository.
• If it leaks, contact us and we'll revoke it and issue a new one.

When it fails

A missing or invalid token gets a 401:

{ "error": "Unauthorized" }