Authentication

Every request to the /v1 API is authenticated with an API key sent as a bearer token in the Authorization header:

Authorization: Bearer adb_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxx

There are no cookies or sessions — the key is the only credential.

Getting a key

Keys are issued in one of two ways:

• A network administrator mints a key (for a person, or for a service account) scoped to the networks and role they choose.
• You manage your own keys self-service under /v1/apikeys.

In both cases the secret token is returned only once, at creation, in the token field. Store it securely — it cannot be retrieved again. If you lose it, revoke the key and create a new one.

Tokens are prefixed by environment, e.g. adb_live_… for live keys.

Scopes and roles

A key carries a set of scopes — each scope grants a role on one network:

Role	Can do
read_only	Read resources within the network.
administrator	Read and write resources, manage members, mint keys.

A key can only ever act within the networks it is scoped to, at the granted role. When a key creates another key, the new key's scopes must be a subset of the parent's access — you cannot grant access you do not have.

Some keys are flagged super_user, which bypasses scope checks platform-wide. Super-user keys can only be minted by another super-user.

Discover your access

Call GET /v1/me to see what the calling key can reach before making network-scoped calls:

cURL

curl https://api.adbridge.ai/v1/me \
  -H "Authorization: Bearer $ADBRIDGE_API_KEY"

Python

import os
import requests

resp = requests.get(
    "https://api.adbridge.ai/v1/me",
    headers={"Authorization": f"Bearer {os.environ['ADBRIDGE_API_KEY']}"},
)
resp.raise_for_status()
print(resp.json())

Node.js

const resp = await fetch("https://api.adbridge.ai/v1/me", {
  headers: { Authorization: `Bearer ${process.env.ADBRIDGE_API_KEY}` },
});
if (!resp.ok) throw new Error(`HTTP ${resp.status}`);
console.log(await resp.json());

Go

req, _ := http.NewRequest(http.MethodGet, "https://api.adbridge.ai/v1/me", nil)
req.Header.Set("Authorization", "Bearer "+os.Getenv("ADBRIDGE_API_KEY"))

resp, err := http.DefaultClient.Do(req)
if err != nil {
    log.Fatal(err)
}
defer resp.Body.Close()
body, _ := io.ReadAll(resp.Body)
fmt.Println(string(body))

Java

HttpRequest request = HttpRequest.newBuilder()
    .uri(URI.create("https://api.adbridge.ai/v1/me"))
    .header("Authorization", "Bearer " + System.getenv("ADBRIDGE_API_KEY"))
    .GET()
    .build();

HttpResponse<String> response = HttpClient.newHttpClient()
    .send(request, HttpResponse.BodyHandlers.ofString());
System.out.println(response.body());

{
  "key_name": "billing-sync",
  "super_user": false,
  "scopes": [
    { "network_id": "7Hb2Kp9QvL3mNx0R8tZ4", "role": "administrator" }
  ]
}

Service accounts

A service account is a non-human identity that belongs to a network — use it for integrations and automation so credentials don't ride on a person's account. An administrator creates one under /v1/networks/{networkId}/service-accounts, mints its first key, and the account then drives the API like any other key holder. See the Service accounts reference.

Authentication errors

Status	Meaning
401 Unauthorized	The Authorization header is missing, malformed, or the key is invalid, revoked, or expired.
403 Forbidden	The key is valid but not authorized for this network or at this role.

Both are returned with the standard error envelope.

Revocation is immediate

Revoking a key takes effect right away — in-flight and subsequent requests with that token start returning 401.