Authentication
Dashboard

Authentication

Authenticate every request with an API key in the Authorization header.

How it works

Send your key as a Bearer token in the Authorization header:

bash
curl -sS https://api.appficient.nl/v1/clients \
  -H "Authorization: Bearer apf_your_key_here"

Without a valid key you get 401. The body follows the error envelope on Errors.

Rules

  • Each key belongs to one Appficient environment. Never send an environment or tenant id — it always comes from the key.
  • Keys do not expire, but you can revoke them any time under Settings, API. Revoked keys return 401 immediately.
  • Use a separate key per integration so you can disable one without touching the others, and see which integration made which calls.

What you never do

  • Put a key in frontend code, an app, or a public repository. Anyone who sees it can access your data.
  • Share a key across customers or environments.
  • Put a key in a URL or query parameter. Always use the Authorization header.

Think a key leaked? Revoke it immediately and create a new one.