FortifiersDevelopers
All documentation
Getting StartedAvailable

Authentication

Securely authenticate server-to-server requests with Fortifiers API keys.

1

API key header

Protected v1 routes authenticate with X-API-Key. Bearer authentication is not used for public v1 API keys.

http
X-API-Key: YOUR_API_KEY
2

Key modes

Keys can represent test or live traffic. Test-mode requests return safe test responses on supported endpoints; live calls count toward the workspace API allowance.

  • Test: integration development and validation.
  • Live: production requests and usage accounting.
3

Storage and rotation

Treat an API key like a password. Store it in a managed secret store, scope access to the service that needs it, and rotate it whenever exposure is suspected.

  • Use separate keys per environment and integration.
  • Revoke unused keys from the API Keys page.
  • Redact headers from logs and error-reporting tools.
  • Rotate production keys on a regular schedule.
4

Authentication failures

Missing or invalid keys return 401. A live key that has reached its allowance returns 429.

json
{
  "detail": "Invalid API Key"
}