Authentication

API Reference

Authentication

Authentication ensures that only authorized users and applications can access the platform’s APIs. All API requests require valid authentication headers.

API Key Management

  • X-CLIENT-ID and X-CLIENT-SECRET can be generated in your console and must be included in the request headers.
  • These keys are unique to each organization and should be kept confidential.
  • Rotate keys periodically to maintain security best practices.

Bearer Token Authentication

  • Once your API key is generated, it can be exchanged for a Bearer token to be used in requests.
  • Include the token in the Authorization header as:

Advanced Security Features

IP Filtering

Early Access

This feature is currently in Early Access and is available for Enterprise clients only. Please contact our support team to enable IP whitelisting for your organization.

Restrict API access to specific source IPs or networks when required by your organization’s policy.

  • IP filtering limits which source IPs are allowed for your API key. When enabled, only requests from whitelisted IPs or CIDR ranges are allowed.
  • The authentication happens here in two stages, first is the token authentication using X-Client-Id and X-Client-Secret as above and then the request is validated against the CIDR(s) set for your key.
  • Whitelists can include upto 5 CIDR ranges (e.g. 221.100.5.0/24, 120.60.209.10/32). It has support for IPv4.

Rate Limits

  • To ensure fair usage and platform stability, the APIs enforce rate limiting, which restricts the number of requests an API key can make within a specific time interval; exceeding this limit will result in an error response. For more details visit the page Rate Limits.