Skip to main content
All Spirii Public API requests must be authenticated. The API uses bearer tokens sent in the Authorization header.

​
Create an API key

Create an API key via Spirii Connect. Navigate to API tokens under Team Access. Upon creation, you will receive your unique API key via a secure one-time link. This link can only be opened once, so ensure you store your key securely after accessing it.
Only Spirii Connect users with an Operator role or higher can create API tokens.

​
Authorize a request

Send the key in the Authorization header, prefixed with Bearer:

​
Security best practices

Treat API keys like passwords. Never commit them to source control or embed them in mobile apps or front-end bundles.
  • Store keys in a secret manager or environment variables — never in code.
  • Rotate keys regularly. To rotate without downtime: provision a new key, roll it into your application, then revoke the old one.
  • Restrict outbound calls to the Spirii API to known IP ranges where possible.