Skip to main content

Authentication

The Terros API uses API keys for authentication. This guide will walk you through the process of obtaining your API credentials and making your first request to the Terros API.

Obtaining Credentials​

To obtain your API key, navigate to the API Keys page in your company settings. You must have permission to create API keys or be a company admin. Our support team will guide you through the process and address any specific requirements you may have.

Security​

Remember that your Terros API key is a secret. Anybody with your Terros API key can use it to take actions on behalf of your user account.

Do not commit the API key to version control systems (such as Git). To keep your credentials secure and prevent accidental exposure, we highly recommend the following best practices:

  • Use Environment Variables: Store your API key in a local .env file and reference it dynamically within your application. Always ensure your .env file is included in your .gitignore so it is never pushed to a remote repository.
  • Keep it Server-Side Only: Never embed or expose your API key in client-side code. This includes front-end JavaScript (like React or Vue), mobile applications, or downloadable desktop clients where bad actors could easily extract it.
  • Rotate When Necessary: If you suspect your key has been leaked, exposed, or compromised in any way, immediately revoke it from the API keys page and generate a new one to replace it.

Authenticating Requests​

You must include your API key in the header of every request to authenticate.

Authorization: ApiKey <YOUR_API_KEY>

All API requests should be made to the base URL:

https://api.terros.com

Authorization Errors​

If you receive a 403 Forbidden response, it means that your API key is invalid or has been revoked. Please contact our support team for assistance. For example:

{
  "message": "Forbidden"
}

Making your first API request​

Let's make a simple request to the Terros API to retrieve your user profile information. You can use the following cURL command to make the request:

export TERROS_API_KEY="<YOUR_API_KEY>"
curl -X POST "https://api.terros.com/user/get" -H "Content-Type: application/json" -H "Authorization: ApiKey $TERROS_API_KEY" -d '{}'