Authentication

The Admin API uses HTTP Basic Authentication to secure all endpoints.

How to Authenticate

1. Obtain your Admin API key from the Admin API section of the Console, and copy its API key secret. Treat these credentials as sensitive information. Do not share or expose them in public repositories or client-side code.
2. Include an Authorization header in every request to the Admin API:

Authorization: Basic <credentials>

Example

The value you authenticate with is the API key secret, and it goes in the password position of the Basic credentials. It is not the bare secret: it is the API key ID, a literal ., then the secret. The secret endpoints, such as GET /admin/workspaces/{workspaceId}/movementApps/{appId}/apiKeys/{apiKeyId}/secret, return it in that form as apiKeySecret, so use the value verbatim.

If your org name is my_org (any value works, org_name is for your own reference and the server ignores it) and your API key secret is 1234.bVAynbc234qafdsg2345sdfrfF, encode my_org:1234.bVAynbc234qafdsg2345sdfrfF in Base64 to get bXlfb3JnOjEyMzQuYlZBeW5iYzIzNHFhZmRzZzIzNDVzZGZyZkY=. Use that value in your Authorization header.

Authorization: Basic bXlfb3JnOjEyMzQuYlZBeW5iYzIzNHFhZmRzZzIzNDVzZGZyZkY=

Testing your API Key

The Admin API has no dedicated credential-test endpoint. To check that your API key secret works, make a read you are authorized for. Fetching a Workspace is the simplest.

Example

1. Send a GET request for a Workspace your API key can access, with your Basic Authentication header. No request body is required. Every Workspace has a unique ID, which any member of that Workspace can view in the Console.

GET /api/v1/admin/workspaces/{workspaceId} HTTP/1.1
Host: app.movementinfrastructure.org
Authorization: Basic <Base64-encoded-credentials>

curl https://app.movementinfrastructure.org/api/v1/admin/workspaces/{workspaceId} -H "Authorization: Basic <Base64-encoded-credentials>"

2. Check the response:
   1. A 200 OK response confirms your credentials are valid.
   2. A 401 Unauthorized response means your credentials are missing, malformed, or invalid.
   3. A 403 Forbidden response means your credentials are valid but the API key is not authorized for the Admin API, or for the Workspace you requested.

Notes

• All API requests must use HTTPS to protect credentials and data in transit.
• All API requests must include the Authorization header.
• If authentication fails, see Testing your API Key above for what 401 and 403 each mean.
• Never share your API key secret.
• For more details, see the HTTP Basic Authentication specification.