Authentication

Server-to-server integrations authenticate with an API key. The dashboard uses short-lived portal tokens. Both identify your organization and scope what a request can do.

API keys

Create and manage keys under Settings → API keys. Send your key in the X-Api-Key header on every request:

bash

curl "https://api.getauthorigin.com/api/v1/products" \
  -H "X-Api-Key: $AUTHORIGIN_KEY"

A key may also be supplied as a bearer token — Authorization: Bearer ak_live_xxx — if that fits your HTTP client better. The two are equivalent for API keys.

Treat keys like passwords

Keys are shown in full only once, at creation. Store them in a secret manager, never in client-side code or version control. If a key leaks, revoke it immediately.

Scopes

Each key is granted a set of scopes that limit what it can do — grant only what an integration needs. A request lacking the required scope returns 403 with code INSUFFICIENT_SCOPE. Typical scopes include:

products.read / products.write — read or manage products
batches.write and barcodes.generate — create batches and mint codes
product_units.write — activate or suspend units
analytics.read and scans.read — read scans and analytics
webhooks.write — manage webhook endpoints

Rotation & revocation

Keys can be rotated without downtime (a new secret for the same key) or revoked when no longer needed. For security, key management is done by an administrator in the dashboard (Settings → API keys) with a signed-in session — not with an API key itself.

Portal tokens

The web dashboard signs users in and calls the API with a short-lived JWT access token in the Authorization: Bearer header, refreshed automatically. This flow is for interactive users — for your own backend integrations, use an API key.

Public endpoints

A few endpoints need no authentication because they're used by the public: product verification (GET /v/{token}), consumer counterfeit reports, sign-up, and the contact form. These are rate-limited by IP — see Errors & rate limits.

NextWebhooks →