Authentication

Securely authenticate your applications with Developer X using OAuth 2.0 or API Keys.

Alex Mercer

Last updated: Oct 24, 2024

Overview

Developer X provides two primary methods for authenticating requests to our APIs: API Keys for server-to-server communication, and OAuth 2.0 for applications that need to access resources on behalf of a user.

API Keys

To authenticate using an API key, include it in the Authorization header of your HTTP request as a Bearer token.

cURL Example

Authenticate a request with a Bearer token in the Authorization header.

curl -X GET "https://api.developerx.com/v1/users" \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json"

OAuth 2.0

Use OAuth when your application acts on behalf of a user. Redirect to the authorization endpoint, exchange the code for an access token, and refresh before expiry. Store refresh tokens server-side. Scopes should be the minimum the feature needs — do not request admin if you only need read.

Key Rotation

Create a second API key, deploy it, then revoke the old one. Overlapping keys avoid downtime. Rotate on a schedule and immediately after anyone with access leaves the team. Keys that appear in logs or tickets are compromised — revoke them the same day.

Scopes and Least Privilege

Workspace keys can be limited to read, write, or billing. Prefer a key per service over one shared secret. If a consumer only lists resources, it should not be able to delete them. Failed authorization returns 403 with a stable error code you can handle in the client.