Skip to main content
POST /login is deprecated. It keeps working until 31 January 2027. From 1 February 2027, the API accepts integrations only with an API credential, and integrations that still use POST /login can no longer access the API. To switch, see Migrate to OAuth 2.0 API credentials.
Use this method only for existing integrations until you switch them. New integrations must use an API credential. See Authentication.
All API examples in this guide use ${BASE_URL} as a placeholder. Replace it with the correct base URL configured for the correct environment. For more information see Environments page.

​
Obtain a session token

Exchange your static API key, username and password for a session token via POST /login:

​
Use the session token

Send the session token in the Authorization header and the API key in the X-Api-Key header. Legacy calls use the paths without /v2:

​
Session token expiration

Session tokens expire after one hour. When a call returns 401 Unauthorized, call POST /login again and retry the call.

​
Where to go next

Migrate to OAuth 2.0 API credentials

Move your integration to API credentials by 31 January 2027.

Authentication

Get an access token with an API credential and call the /v2 API.