Log in

Welcome back.

30-second reminder

Right where you left off.

API keys outlive sessions — mint, rotate, revoke from the dashboard. Bearer session tokens are short-lived (15 min) and treat them like the .p12 password they unlock.

API keys are durableSet X-Api-Key on every request. Rotate from the dashboard at any time; the old key works until you revoke it.
Sessions are ephemeral15-minute TTL. On 401 SESSION_EVICTED, transparently re-open and retry.
Always-fresh playgroundHit the OpenAPI 3.1 interactive playground from the dashboard. Try-it-out works with your real key.

# The auth handshake, in three lines.
1. POST /api/v1/sessions          → bearer token, 15-min TTL
2. POST /api/v1/ecf/issue-stateless → signed XML + TrackID
3. DELETE /api/v1/sessions/current  → drop the token (optional)

Dashboard tour·API reference·Session auth

Log in ​

Log in