Authentication Overviewlink

The Infraspeak API uses Bearer token authentication to secure all API requests. This guide explains the authentication system and helps you choose the right approach for your integration.

How Authentication Workslink

Every API request must include a valid Bearer token in the Authorization header:

curl "https://api.infraspeak.com/v3/locations" \
  -H "Authorization: Bearer YOUR_TOKEN"

The API validates your token and:

• Identifies the account associated to the token and your organization
• Determines your permission level
• Tracks usage against rate limits
• Logs the request for audit purposes

Personal Access Tokens (PAT)link

Personal Access Tokens are the primary authentication method for API integrations.

PATs provide an easy way to work with Infraspeak REST API and allow clients to run automation without an interactive login. They are a widespread standard used across well-known organizations and services, such as Github, Microsoft and Atlassian, for example.

Our PATs are long-lived, so you don't need to refresh them. They become invalid when revoked.

PATs are valid only for the environment where they are generated.

Quick Startlink

1. Store Securelylink

Once you have your token, save it in a secure location (environment variable, secrets manager):

export INFRASPEAK_TOKEN="your_token_here"

2. Make Requestslink

Include the token in all API requests:

curl "https://api.infraspeak.com/v3/locations" \
  -H "Authorization: Bearer $INFRASPEAK_TOKEN"

Authentication Errorslink

Error Response Formatlink

{
  "status": "error",
  "error": {
    "http_code": 401,
    "message": "Authentication token invalid."
  }
}

Security Best Practiceslink

1. Never expose tokens in client-side code - Tokens should only be used server-side
2. Use environment variables - Don't hardcode tokens in source code
3. Rotate tokens if needed - Replace tokens in case of potential breachs
4. Monitor token usage - Keep a log of API requests and review for unusual activity