Every request to the Personyze API is authenticated with an API key. You can generate and revoke keys here, under Account settings → Integrations.
How to send it
HTTP "Basic" authentication over HTTPS. The username is always the literal string api; the password is your key. No other headers are required.
Most HTTP clients let you put the credentials in the URL, which is what the examples throughout this documentation do:
curl 'https://api:FD09908F25BECB09D78EBEA1DADFB618651F612D@app.personyze.com/rest/account'If your client doesn't support that form, send the header yourself — its value is the base64 encoding of api:{YOUR_KEY}:
curl -H 'Authorization: Basic YXBpOkZEMDk5MDhGMjVCRUNCMDlENzhFQkVBMURBREZCNjE4NjUxRjYxMkQ=' 'https://app.personyze.com/rest/account'Requests must use HTTPS. A plain HTTP request is rejected with 401, the same as a bad key — the key must never travel unencrypted.
Testing a key
GET /rest/account is the cheapest way to check that a key works. It reads nothing and changes nothing, and returns the account id the key belongs to:
{"id": 362}A 401 means the key is wrong, revoked, or the request wasn't over HTTPS.
Types of key
Full-featured API key — full access to every object in this documentation, including reading and deleting user data.
Zapier password — the same thing under a different name. Keys generated on the Zapier card also appear under Full-featured API and vice versa, and either one authenticates any endpoint. See zapier_users.
Wordpress key — restricted. It can only view, add, update and delete placeholders whose name starts with Wordpress:.
Keeping keys safe
An API key grants the right to read, modify and permanently delete data on your account. Treat it like a password:
- Store it in your application's secret store, not in source control, and never in client-side code — a key in browser JavaScript is a key you have given away.
- Give each integration its own key, so one can be revoked without breaking the others.
- Revoke immediately if a key may have leaked. Deleting a key takes effect at once: any application still using it starts receiving
401, so generate the replacement and roll it out first.
There is no way to recover the value of an existing key — if you lose it, generate a new one and revoke the old.