Skip to main content
Thought Industries Developer Hub
https://.thoughtindustries.com

Authentication

The REST API uses Bearer token authentication. Include your API key in the Authorization header of every request.

Obtaining an API key

Generate an API key from the Thought Industries admin panel under Settings → API Keys. Each key is scoped to a single instance and inherits the permissions of the role assigned to it at creation.

Treat API keys as secrets. Never commit them to version control or expose them in client-side code.

Making authenticated requests

Pass the API key verbatim after the Bearer scheme — the value is the key itself, with no prefix added by Thought Industries.

curl -X GET "https://api.thoughtindustries.com/incoming/v2/users" \
  -H "Authorization: Bearer $TI_API_KEY"
const response = await fetch("https://api.thoughtindustries.com/incoming/v2/users", {
  headers: {
    "Authorization": `Bearer ${process.env.TI_API_KEY}`,
    "Content-Type": "application/json"
  }
});

const data = await response.json();
import os
import requests

response = requests.get(
    "https://api.thoughtindustries.com/incoming/v2/users",
    headers={"Authorization": f"Bearer {os.environ['TI_API_KEY']}"}
)

data = response.json()
$ch = curl_init("https://api.thoughtindustries.com/incoming/v2/users");
curl_setopt($ch, CURLOPT_HTTPHEADER, [
    "Authorization: Bearer " . getenv("TI_API_KEY"),
    "Content-Type: application/json"
]);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);

$response = curl_exec($ch);
$data = json_decode($response, true);

Unauthorized responses

When authentication fails, the API returns 401 Unauthorized with an empty response body. Common causes:

  • Missing Authorization header
  • Incorrect API key (typo, wrong instance, or revoked)
  • Instance does not have API access enabled
  • Key lacks permission for the requested resource

Because the body is empty, applications should treat any 401 from the REST API as an authentication failure — inspect the request headers rather than a response payload.

Security best practices

  • Rotate API keys on a regular schedule.
  • Store keys in environment variables or a secrets manager — never in source control.
  • Assign each key the minimum role required for its use case.
  • Revoke keys immediately if you suspect compromise.

Related