Authentication

Every Reporting API request uses an Authorization: Bearer header. Use an organisation API key for server integrations or an OAuth access token for an approved MCP client.

Organisation API keys

Owners and admins manage keys in Settings → API keys. A key belongs to its organisation and can be restricted to selected teams. Removing its creator from the organisation does not automatically revoke an organisation-owned integration key; review and revoke those keys when a colleague leaves.

• The only currently supported reporting scope is reporting:read.
• Keys read the organisation’s teams, limited further by an optional team allowlist.
• API access depends on the organisation’s current plan.
• The full secret is shown only at creation. Revocation takes effect on subsequent API requests.
• Rotate by creating a replacement, updating the consuming application, verifying it, and revoking the old key.

A key does not grant access to dashboard administration, billing changes, database operations, or another organisation’s data.

OAuth for MCP clients

OAuth lets a person approve a client without copying an API key. They choose an organisation and the teams the client may read. The approval cannot grant more access than the person has. Owners and admins can disconnect clients under Settings → API keys → Connected AI clients.

Use the OAuth integration guide if you are developing a client. Never use a refresh token as an API bearer token.

Protect credentials

Store keys and refresh tokens in a secret manager or the client’s secure credential store. Do not put them in URLs, source control, screenshots, browser bundles, or support tickets. Example commands use environment variables and contain no usable credentials.

Use credentials from the same environment as the endpoint. Staging and production credentials are separate.