At a glance#
Every request carries your app's key in the api360key header. No sessions and no cookies. An app set to HTTP Basic sends its username and password in the standard Authorization header instead.
api360key: REPLACE_WITH_YOUR_KEY
Headers#
| Header | Value | When |
|---|---|---|
api360key | your app's key | every request |
Authorization | Basic and the base64 of username:password | only for apps set to HTTP Basic |
Content-Type | application/json | every request that has a body |
Methods#
| Method | When to use it | Note |
|---|---|---|
| API key | default | the simplest, and enough for most cases |
| HTTP Basic | alternative | a generated username and password for the app, sent in the Authorization header |
A key or a Basic credential belongs to one app, and an app to one environment. A wrong or missing credential gets the same 403 as a missing subscription: No active subscription for this product.
The key is a server-side secret#
Never put a key in a browser, a mobile app or a public repository. If a call has to start in the front end, send it through your own server. To replace a key without downtime, see apps and keys.
Planned
OAuth 2.0 client credentials with scoped tokens, and mutual TLS, as further ways for an app to authenticate.
See also#
Updated 2026-10-17