Skip to main content

Authenticate API requests

Every call to the platform API must be authenticated with an API key. The key identifies your account and, through its assigned scopes, determines which operations the call is allowed to perform. This page shows how to attach a key to a request and how scopes control access.

Before you begin​

  • An account role that lets you create or view API keys (typically an admin). (Confirm the exact permission in your account.)
  • An active API key. Generate one in the account settings area under the developer or API section, and copy the secret value when it is shown — it is usually displayed only once. (Confirm the exact steps in your account.)
  • The scopes your integration needs (for example, read-only reporting versus permission to send a Broadcast). Assign the narrowest set that still gets the job done.
  • The base URL for your account's API, plus a tool to make HTTPS requests (curl, Postman, or your language's HTTP client).

Steps​

  1. Store the key securely. Keep it in an environment variable or secrets manager — never hard-code it in client-side code or commit it to source control.
  2. Attach the key to each request. Send it in an authorization header over HTTPS, for example Authorization: Bearer YOUR_API_KEY. (Confirm the exact header name and format in your account's API reference.)
  3. Make a low-risk test call. Hit a read-only endpoint first (such as a reporting or account lookup) to confirm the key works before running write operations.
  4. Check the scope. If a call is rejected, verify the key has the scope that endpoint requires, then retry.

Result​

A properly authenticated call returns a normal success response (HTTP 2xx) with the expected data. A missing or invalid key returns 401 Unauthorized; a valid key without the required scope returns 403 Forbidden. Rotate or revoke a key immediately if you suspect it has been exposed.

Canonical terms: Author, Edition, Folder (Project Folder), Broadcast. See the Glossary.