On this page
At a glance#
Every request to a product carries a credential of the app that makes it, in the api360key header. There are no sessions and no cookies. A credential is created on the Authorization tab of an app, is one of two types, and belongs to the app and so to its environment.
api360key: REPLACE_WITH_YOUR_KEY
The api360key header and the others#
| Header | Value | When |
|---|---|---|
api360key | the API key of an app | every request that uses an API key |
Authorization | Basic and the base64 of username:password | only with a credential of type Basic auth |
Content-Type | application/json | every request that has a JSON body |
The gateway also reads the key from a query parameter named api360key. Prefer the header: a URL is written to logs and history, and a header is not.
Credential types#
| Type | What the platform generates | How you send it |
|---|---|---|
| API key | 64 random letters and digits, with no prefix | the api360key header |
| Basic auth (HTTP Basic) | a username and a 64-character password | the Authorization header |
An app can hold several credentials of either type at the same time, and each works on every product the app is subscribed to. A credential has no expiry date. The platform keeps it and shows it again every time you open the Authorization tab (apps and keys).
What an unrecognised credential gets#
The gateway answers 403 with {"message": "No active subscription for this product"} when it cannot match a call to a subscription. That is the answer to a call with no credential, with a credential it does not know, with the credential of the other environment, and with a credential in a header the gateway does not read, such as x-api-key or a bearer token. See errors, status codes and retries.
The key is a server-side secret#
Never put a key in a browser, a mobile app or a public repository. If a call has to start in the front end, send it through your own server. To replace a key without downtime, see apps and keys. The playground is the one place where the portal sends a key from a browser: your own key, from your own signed-in session.
OAuth 2.0 client credentials with scoped tokens, and mutual TLS, as further ways for an app to authenticate.