Authentication

Authenticate every request with a secret key in the Authorization header, scoped to what it needs.

Applies to

v1 + v2

→

Changed in v2

Code written for v1 needs a small update for this topic. The migration guide shows each change side by side.

Open the migration guide

Authorization header

1# Placeholder: Fernway is a fictional API.
2curl https://api.fernway.example/v2/messages \
3  -H "Authorization: Bearer $FERNWAY_API_KEY"

API keys

Fernway uses secret API keys. Send the key as a Bearer token in the Authorization header on every request. Requests without a valid key return 401 unauthenticated. Keys are tied to one workspace and one environment, test or live.

Scopes

Each key carries scopes such as messages:write or webhooks:read. Give each service the smallest set of scopes it needs. A request outside a key's scopes returns 403 forbidden with the missing scope in the error body.

Changed in v2

v1 accepted keys as a query parameter. v2 only accepts the Authorization header, so update any client that still appends ?api_key= to URLs.

Placeholder API

Fernway is a fictional product used to show how this template works. Replace these docs with your own in the CMS.

← Quickstart

SDKs →