How to authenticate with the Alladdin API using Bearer tokens.

🔑 Bearer tokens 🛡️ Scoped permissions 🔐 HTTPS only auth-flow verifying 🔑 Authorization: Bearer sk_live_•••• Validating token... 🛡️ ✓ Token valid · scope: invoices.read invoices.read contacts.write products.read

Overview

The Alladdin API uses Bearer token authentication. Every request must include a valid API key in the Authorization header.

Getting your API key

You can find your API key in the Alladdin dashboard:

1. Go to Settings → API in your Alladdin account
2. Click "Generate new key"
3. Copy the key and store it securely, it won't be shown again

Using your API key

Include the key in the Authorization header:

curl -H "Authorization: Bearer YOUR_API_KEY" \
  https://api.alladdin.com/api/v2/invoices

Permissions

Each API key has scoped permissions. Endpoints document which permission they require (e.g., sales:invoices.read). If your key lacks the required permission, you'll receive a 403 Forbidden response.

Security best practices

• Never expose your API key in client-side code
• Use environment variables to store keys
• Rotate keys periodically
• Use the minimum required permissions for each key