API Tokens and Security

We provide a valid, signed certificate for our API endpoints. Make sure your connection library supports HTTPS with the SNI extension.

API requests are authenticated using account API tokens. The tokens are keys that grant access to specified endpoints and access to HTTP methods on those endpoints. An authorized API token must accompany every request--requests will otherwise return an error.

Token Types:

• Publishable API tokens are meant solely to identify your account; they aren’t secret. They can be published in places like your website code or mobile app code.
• Secret API tokens can perform any API request authorized for your account. They should be kept confidential and should only be stored on your own secure servers.

The Console's API Tokens page lists your tokens and enables you to manage tokens.

See Access and Security to learn best token protection practices, and how to use and manage tokens.