Authentication
How Eventdoor API credentials authenticate: the bearer token, read and write access, scope, expiry and revoking.
Every REST API request carries a scoped API credential. You issue credentials in the admin; there is no other way to get one.
Send the token
Send the token as a bearer token on every request:
Authorization: Bearer edk_...A token has the form edk_<id>_<secret>. Send the whole string.
curl -s -H "Authorization: Bearer $EVENTDOOR_TOKEN" \
"$EVENTDOOR_API/organizations/acme/hubs"The credential is checked on every request before anything else. A token in the edk_... form that does not authenticate gets 401, even on an operation that would otherwise be public. A bearer token that does not start with edk_ (lowercase) is not treated as a credential: on a public read it is served as an anonymous request, with no error, and returns only what anyone may see. See Errors and rate limits.
Access levels
When you issue a credential, you choose its Access:
| Access | In the API | What it may do |
|---|---|---|
| Read only | read | GET requests only, acting as a member of the organization. Can view what a member of this organization can view. Changes nothing. |
| Read and write | write | Acts as an admin of the organization. Never as an owner, and can't manage members or credentials. |
A Read only credential cannot read a broadcast's change history; that needs Read and write.
No credential ever acts as an owner or a system admin, and none unlocks paid content.
Scope: one organization or the whole platform
- An organization's credential reaches that organization only. A request for any other organization is refused with
403. - A platform-wide credential reaches every organization on the platform except internal ones. A Read and write one acts as an admin in each.
A credential is not a user
A credential is not a user: it has no profile, is not a member, and keeps working when the person who issued it leaves. The changes it makes name the credential.
Who can issue a credential
- For an organization: its owners and admins. In the admin sidebar, open Settings, then the Integrations tab, and find API credentials. Only the organization's owners and admins, and platform admins, can see and revoke its credentials.
- Platform-wide: platform admins, from Settings > Integrations on the platform itself.
The getting started guide walks through the Issue credential dialog.
Expiry
No credential lasts forever. Every one expires after the period you choose: In 30 days, In 90 days or In 1 year. The default is 1 year. After it expires, its requests get 401 This API credential has expired; issue a new one.
The API credentials table shows each credential's Name, Status (Active, Expired or Revoked), Access, Token (its first characters only), Created, Expires and Last used.
Revoking
To stop a credential, open its row's menu in the API credentials table and choose Revoke. The confirmation explains what happens:
Anything using this token stops working at once: its next request is refused. The credential stays in the list as revoked, and the changes it made still name it. This can't be undone.
Keep the token secret
The token is shown once, when you issue it. Only a fingerprint of it is stored, so it cannot be shown again. If it's lost, revoke the credential and issue a new one.
- Keep the token on your server or in a secret store, such as a password manager or your tool's secret settings.
- Never ship it in a browser or a mobile app.
- Issue one credential per tool, with the least access it needs, so you can revoke one without breaking the others.