API authentication
Authenticate server-to-server requests and keep integration credentials safe.
Bearer API keys
Send the key in the Authorization header on every link-generation or comment-ingestion request:
Authorization: Bearer gfi_your_secret_key
Content-Type: application/json
API keys belong only in a trusted backend. Do not embed them in browser JavaScript, mobile applications, URLs, analytics, or client-visible error messages.
Idempotency
Every mutation also requires an Idempotency-Key header. It must contain 8–200 characters from A-Z, a-z, 0-9, ., _, :, or -.
Use a stable event identifier, such as comment:987654:v1. Retry a timed-out request with the same key. Use a new key only for a genuinely new operation. Reusing a key with different input is rejected rather than silently changing the original operation.
Authentication failures
A missing, malformed, unknown, or rotated key returns 401. An authenticated integration that is disabled or lacks the requested capability returns 403.
Do not retry either status automatically. Check the integration in the Genesis Admin dashboard or contact Genesis.
Rotation
Rotating an API key immediately invalidates the previous key. Deploy the replacement to your server as one coordinated change and verify a low-risk request. If a key may have leaked, rotate it first and investigate logs second.