Authentication

No public API credentials

This page describes the access model in the illustrative API design preview. API access is issued per client under a written agreement; this website does not issue keys and there is no public test environment.

Model in the preview

The preview uses a bearer token over HTTPS. A token belongs to one approved company and connection, with only the permissions needed for that job.

Authorization: Bearer <future-token>

The value above is only an example. Never put a real password or token into this website or its contact form.

Design principles

• credentials will not be accepted in a URL;
• tokens will be treated as secrets in storage and in transit;
• each connection will receive only the permissions it needs;
• tokens will be replaceable and revocable;
• requests that change data will be designed so a safe retry does not create duplicates.

These principles describe the design preview. The access arrangements for a client integration are agreed in writing within that project.