Authentication

Send a bearer token#

Include the token in the Authorization header on every request:

Authorization: Bearer YOUR_API_TOKEN

Use the API token from User Account. Your IRIS Cloud password and browser login session are not API tokens.

Access belongs to your organization#

The token is associated with the organization in which it was created. The API checks the token and organization access before returning data. Knowing another machine’s ID does not grant access to it.

The documented integration operations read data. They do not change machine settings or create production batches.

Authenticate in the API reference#

1. Open the API reference and confirm the environment.
2. Select Authorize.
3. Paste only your token. Swagger adds the Bearer prefix.
4. Choose an endpoint, select Try it out, fill in its parameters, then select Execute.
5. Use Logout in the authorization dialog when finished.

Keep tokens in your integration’s backend#

Store tokens in a secret manager or protected environment variables. Do not embed them in publicly delivered browser code, commit them to a repository, or share them in URLs.

For a lost or exposed token, revoke it in IRIS Cloud and update the integration with a new token. See authentication errors for expired, revoked or invalid tokens.