Authentication
API authentication and token management
Authentication
All InboxIssue API requests require Bearer token authentication.
API Token
Include your API token in the Authorization header:
Obtaining an API Token
- Log in to InboxIssue
- Navigate to Settings > API Tokens
- Click Generate New Token
- Copy and securely store your token (it won't be shown again)
API access is available on Pro and Enterprise plans only.
Example Request
Base URL
All API endpoints use this base URL:
Authentication Errors
| Status Code | Error | Description |
|---|---|---|
| 401 | Unauthorized | Missing or invalid API token |
| 403 | Forbidden | API access not available on your plan |
401 Unauthorized
Solutions:
- Verify your API token is correct
- Check that the token hasn't been revoked
- Ensure the
Authorizationheader is properly formatted
403 Forbidden
Solution: Upgrade to Pro or Enterprise plan to access the API.
Token Best Practices
Security
- Store tokens securely (use environment variables, secrets managers)
- Never commit tokens to version control
- Rotate tokens periodically
- Use different tokens for different applications
Example: Environment Variable
Rate Limits
API requests are rate-limited based on your subscription plan:
| Plan | Requests/Hour |
|---|---|
| Pro | 1,000 |
| Enterprise | 10,000 |
Rate limit headers are included in responses:
| Header | Description |
|---|---|
X-RateLimit-Limit | Maximum requests per hour |
X-RateLimit-Remaining | Requests remaining |
X-RateLimit-Reset | Unix timestamp when limit resets |
429 Too Many Requests
Related
- External Tests API - Create and manage tests
- Error Handling - Error codes and handling
- Subscription Plans - API access by plan