Authentication

The Outseta API supports two authentication schemes. Pick the one that matches your use case.

API key (server-to-server)

Use API keys when calling the API from a backend you control. Each key has a paired secret — together they’re sent in the Authorization header.

Authorization: Outseta <API_KEY>:<SECRET_KEY>

You can generate keys from the Outseta admin console under Settings → API Keys.

Never embed an API key + secret in client-side code (browsers, mobile apps). Use bearer tokens for those flows.

For client-side calls (e.g. a logged-in user fetching their own data), use a JWT access token issued by the Outseta auth flow.

Authorization: bearer <ACCESS_TOKEN>

Tokens are short-lived and should be refreshed using the standard OAuth refresh flow.

Use case	Scheme
Backend job, webhook handler, server-side integration	API key
Logged-in browser/mobile session	Bearer token
Public, unauthenticated endpoints (e.g. signup)	None