Overview/Authentication
Overview

Authentication

Authentication keys

When making a request to the AzoraOne API, you will need two authentication keys: a client key and a subscription key.

  • The client key is specific to the API and will be the same for all users with access to the API.
  • The subscription key is specific to the subscription (the connection between a user and an API) and will be different between users.

How to acquire authentication keys

  1. Create a Developer Account
    1. Go to the AzoraOne Developer Portal and register for a free account.
    2. Confirm your email to activate your account.
  2. Find Your Keys
    1. Sign in, then click your profile avatar in the top-right corner.
    2. Select API keys from the dropdown menu.
    3. Your Client Key and Subscription Key are listed there.
  3. Partner API Keys
    1. If you’re developing on behalf of one of our partners and can’t find the required keys for the partner APIs, please contact us.
    2. Our team will help you get access to the keys you need.

When exploring the AzoraOne Sandbox API, the client key will be available to all guests and developers. The subscription key still needs to be generated by creating a developer account. You can create an account and explore the Sandbox API free of charge.

How to use authentication keys

You will need to provide a valid client key and a valid subscription key in the header of each request made to the AzoraOne API.

  • Add the client key to a header named Client-Key
  • Add the subscription key to a header named Ocp-Apim-Subscription-Key
GET https://api.azora.one/{api}/{version}/companies
Client-Key: **********************
Ocp-Apim-Subscription-Key: ********************************

How to keep your authentication keys secure

Your authentication keys should be treated as secrets. Exposing your credentials can result in your data being accessed or compromised. To keep your authentication keys secure, follow these best practices.

  • Do not embed authentication keys directly in the source code
    Authentication keys that are embedded in code or the source tree can be accidentally exposed if someone gains access to your repositories. Instead, store authentication keys in environment variables or in files outside of your source code.
  • Use your authentication keys only where needed
    By restricting the number of servers and/or applications that has access to the authentication keys you can minimize the number of compromising sources. You can also more easily regenerate and replace a compromised authentication key.
  • Regenerate your subscription keys periodically or if compromised
    You can regenerate your subscription keys if you think they might have been compromised, or simply as a precaution from future attacks.
  • Delete unwanted subscription keys
    To minimize the risk of someone gaining access to an older subscription key, delete any authentication keys that you no longer need.

How to regenerate subscription keys

On the API keys page (profile avatar → API keys) you'll find two subscription keys: a primary and a secondary. Having two keys lets you perform rolling updates — if one key is exposed and needs to be regenerated, the other keeps working in the meantime. This means you can switch your application to the secondary key while regenerating the primary, and vice versa, with no downtime.

You can also share the secondary subscription key to grant another party temporary access, then revoke it later by regenerating that key.