Skip to main content
Version: 2025-10

Authentication

&Open API uses Bearer Token authentication to secure all API endpoints. This ensures that only authorized clients can access protected resources.

Overview​

Bearer Token authentication is a simple and secure mechanism where the client includes a token in the Authorization header of each request. If the token is valid and not expired, the server grants access to the requested resources.

How It Works​

  1. Obtain your API key from the &Open dashboard.
  2. Include the token in the Authorization header of every request.
  3. The server validates the token and grants access to authorized requests.

Implementation​

Header Format​

Include the Bearer Token in the Authorization header using the following format:

Authorization: Bearer YOUR_API_TOKEN

Example Request​

curl -X GET "https://api.andopen.co/<path>" \
  -H "Authorization: Bearer your_api_token_here" \
  -H "Content-Type: application/vnd.api+json"
note

Send your requests to the base URL for the region your account was provisioned in. A token presented to the wrong region will fail authentication with a 401 Unauthorized. See Environments for the regional base URLs.

Security Best Practices​

  • Keep your token secure - Treat it like a password and never expose it in client-side code
  • Rotate tokens regularly - Generate new tokens and retire old ones periodically
  • Revoke compromised tokens - Immediately delete any tokens that may have been exposed