Skip to main content
Amplify uses a two-step token flow. Your API key is used only to request an access token. The returned access token is then sent as a Bearer token with customer API requests.

​
How authentication works

1

Get your API key

Copy an API key from Settings → Developer Tools → API Keys in the Amplify dashboard.
2

Generate an access token

Send the API key as api_secret_key in a JSON request to POST /v1/auth.
3

Authenticate API requests

Send the returned data.access_token in the Authorization header using the Bearer scheme.
API keys and access tokens grant access to your Amplify account. Keep them out of browser code, mobile applications, public repositories, logs, and support messages. Store them in server-side environment variables or a secrets manager.

​
Get your API key

In the Amplify dashboard, go to Settings → Developer Tools → API Keys and copy the API key you want your integration to use. Assign the key to a server-side environment variable before running the examples in this guide:
Do not use the API key as the Bearer token and do not send api_secret_key to resource endpoints.

​
Generate an access token

Send a JSON request to the development authentication endpoint:
The request body contains one required property:
​
string
required
The API key copied from Settings → Developer Tools → API Keys.

​
Successful response

​
integer
Application-level result status. The confirmed successful response returns 1.
​
string
Human-readable result message.
​
object
Authentication token details.

​
Authenticate an API request

Read data.access_token from the authentication response and store it securely. Include it in the standard authorization header for every protected customer API request:
For example, to retrieve numbers:
The header must contain the word Bearer, followed by one space and the access token. Do not send the API key in this header.

​
Token lifetime

The confirmed authentication response sets expires_in to 86400 seconds, or 24 hours. Do not assume an access token remains valid beyond that lifetime. Refresh-token behavior has not been confirmed. Design your integration so it can request another access token using the API key when necessary, and avoid generating a token before every API request.

​
Troubleshooting authentication

​
Invalid API key

An invalid api_secret_key returns 401 Unauthorized:
Verify that the value was copied from Settings → Developer Tools → API Keys, has not been truncated, and does not contain extra spaces.

​
Authentication checklist

Check the following before escalating an authentication problem:
  • The token request uses POST https://dev-api.amplify.xyz/v1/auth.
  • The request body is valid JSON and contains api_secret_key.
  • The API key is supplied as the value of api_secret_key.
  • Protected requests use Authorization: Bearer <access_token>.
  • The access token has not exceeded the lifetime reported by expires_in.
  • The API key and access token have not been truncated or copied with extra spaces.

​
Next steps

Generate an access token

Review the authentication endpoint and try it in the API playground.

Quickstart

Generate a token and make your first request to the Numbers API.