Skip to content

authentication.mdx

Latest commit

 

History

History
92 lines (62 loc) · 2.6 KB

authentication.mdx

File metadata and controls

92 lines (62 loc) · 2.6 KB
title Authentication
description How to authenticate Request Network API calls with API keys or Client ID

Overview

Request Network API supports two authentication modes:

  • x-api-key for server-side integrations
  • x-client-id for browser/client integrations (with Origin header)

Use this page as the canonical auth reference. For credential creation and webhook setup in the portal, see API Portal: Manage API Keys and Webhooks.

Choose the Right Method

Method Best for Header(s)
API Key Backend services, cron jobs, trusted server environments x-api-key
Client ID Browser/front-end calls where client auth is required x-client-id (+ Origin)

API Key Authentication

Use API keys for backend calls.

Example

curl -X GET 'https://api.request.network/v2/request/{requestId}' \
  -H 'x-api-key: YOUR_API_KEY'

Client ID Authentication

Use Client ID when your integration needs browser-side authentication flow.

Example

curl -X GET 'https://api.request.network/v2/request/{requestId}' \
  -H 'x-client-id: YOUR_CLIENT_ID' \
  -H 'Origin: https://your-app.example'
For browser-based requests, `Origin` is part of the request context and is required for Client ID auth.

Header Reference

  • x-api-key: API key used for server-side auth
  • x-client-id: Client identifier used for client-side auth
  • Origin: required with Client ID flows in browser contexts

Common Authentication Errors

401 Unauthorized

  • Missing auth header
  • Invalid/expired API key or client ID

403 Forbidden

  • Credentials are valid but not allowed for the requested operation
  • Client ID is revoked or restricted

429 Too Many Requests

  • Request rate exceeded for your credentials

Security Guidance

  • Keep API keys server-side and out of frontend bundles
  • Store credentials in environment variables or secret managers
  • Rotate compromised credentials immediately
  • Verify webhook signatures independently (webhook signing uses a separate secret)

Related Pages

Create credentials and manage webhook configuration. Signature verification and delivery behavior. Full endpoint authentication requirements.