API authentication

OneProvider provides API access for automating common tasks. This page explains, at a high level, how API authentication works and what to check if your requests are rejected.

Where to find/generate API credentials

API credentials are managed from the OneProvider Client Area.

General steps:

1. Log in to the Client Area.
2. Go to the API section (or Security / API tokens, depending on the interface).
3. Create or view your API credential/token.

If you do not see an API section, it may not be enabled for your account or may require additional permissions.

How authentication is used

Most APIs authenticate requests by requiring a credential such as:

• An API token/key, and/or
• A signed authorization header (depends on the API implementation)

When making requests, include authentication exactly as documented for the specific API endpoint you are using.

Security best practices

• Store tokens in a secure secret manager (not in source code).
• Use different tokens per environment (dev/staging/prod).
• Rotate tokens periodically and immediately if exposure is suspected.
• Restrict access to tokens to only the people/systems that need them.

Common authentication errors

• 401 Unauthorized / 403 Forbidden
  • Token is missing, invalid, expired, revoked, or lacks permission.
• Account verification or restrictions
  • Some actions may be blocked until account verification is complete.
• Clock/time issues (signed requests)
  • If the API uses time-based signatures, ensure your system clock is correct.

Getting help

If you are consistently receiving authentication errors, prepare:

• Endpoint you are calling
• Timestamp of the request
• HTTP status code and response body
• Whether the token was newly created or recently rotated

Then contact Support with the above details.