Authentication

Bearer authentication

Send the credential in the Authorization header on every request. No other credential transport is supported.

GET /api/partner/v1/organization HTTP/1.1
Host: api.signagewall.com
Authorization: Bearer $SIGNAGEWALL_PARTNER_API_KEY
Accept: application/json

Credentials in query parameters, URL paths, cookies, or organization headers are ignored and cannot authenticate a request.

Credential lifecycle

An organization can hold multiple active credentials. Names and scopes are fixed after creation so every permission change has a clear migration and audit trail.

1. Create a new credential with the required scopes.
2. Move the integration to the new credential.
3. Verify production traffic.
4. Revoke the previous credential.

Failed authentication

Missing, malformed, unknown, expired, revoked, and organization-invalid credentials intentionally receive the same generic response. The API never confirms whether a credential exists.

{
  "error": {
    "code": "UNAUTHORIZED",
    "message": "Invalid Partner credential.",
    "requestId": "request_id"
  }
}

Transport security

Production Partner API requests require HTTPS. An insecure request is rejected with 426 Upgrade Required. Configure trusted proxy information correctly when TLS terminates at a load balancer.