Authentication

The Signal HTTP API authenticates every request with an organization API key. Create and manage keys in the dashboard.

Send the API key

Send the key in the x-api-key header of each request.

curl --fail-with-body --request GET "$LINKT_API_URL/v2/campaigns?limit=5" \
  --header "x-api-key: $LINKT_API_KEY"

The API also accepts the key as Authorization: Bearer <key>. Use x-api-key when your client can set custom headers.

Key format

An API key starts with sk-. A value that does not start with sk- gives 401. A session token of the Signal web app also gives 401. The web app session and the HTTP API use separate credentials.

Organization scope

Each API key belongs to one user in one organization. A request reads and changes the data of that organization only.

A request for a resource of another organization gives 404. The API does not show that the resource exists.

Product operations require explicit resource permissions. A key uses only the intersection of its assigned permissions and its owner's current access in the organization. An organization role alone does not grant product access. Removing membership disables the key's product access.

Members initially receive Standard use. Admins and Owners initially receive Full product access. Authorized editors can customize these assignments independently of the role. See Permissions for presets, key limits and revocation.

A request that affects several resources needs every required level. A missing level gives 403 access_denied and identifies the resource, action and operation in error.details. The refusal starts no work and spends no credits. Permission checks can precede resource lookup, so a 403 can come before a 404.

Send get_me (GET /me) to read the role of the key user, the organization and the credit balance:

{
  "organization": { "id": "65f1c2a9b8e4d3f2a1b0c9d8", "name": "Example organization" },
  "role": "member",
  "available_credits": 1250.5
}

get_me requires credit_balance.read. Its role field reports the organization role; it does not describe the key's effective product permissions. role is member, admin, owner, or null when no role is available. available_credits is the balance that the start operations check. organization.id is the organization ID that the dashboard and support use.

Error responses

A missing, invalid, expired or revoked key gives 401. A key whose user or organization cannot be resolved also gives 401. A database failure during key verification or caller lookup gives 503 with Retry-After: 1. Wait at least that long, then retry with increasing delays and a bounded retry count. An unexpected authentication fault gives a sanitized 500. These server failures do not mean the key is invalid. See Errors and Retry safely.

A key works only in the environment that issued it. Production keys and staging keys are separate.

curl --fail-with-body --request GET "$LINKT_API_URL/v2/me" \
  --header "x-api-key: $LINKT_API_KEY"

Keep the key secret

• Keep API keys out of browser code, logs, URLs and shared examples.
• Do not print request headers when you debug a request.
• Store the key in a secret store or in an environment variable on the server.