Authentication

Authentication methods

The ION GraphQL API supports two authentication methods: API keys for machine-to-machine integrations and OAuth 2.0 for user-facing applications. Every request uses the same endpoint and Authorization header. Only the way you obtain the token differs.

Endpoint and headers

Every authenticated request targets a single GraphQL endpoint. Include the access token on every request:

POST /graphql HTTP/1.1
Host: api.buildwithion.com
Authorization: Bearer <token>
Content-Type: application/json

ION also accepts Authorization: Token <token> for backward compatibility. Prefer Bearer. For multipart file uploads, set Content-Type: multipart/form-data. Follow the flow in File Upload.

Troubleshooting

When ION rejects a request during authentication, the response carries an errors[].message payload:

{
  "errors": [{ "message": "Token is expired." }]
}

For the full list of authentication failures and their fixes (401 Unauthorized, 403 Forbidden, rate limits, and 5xx errors), see Error codes.

⌘I

Getting Started

Build Hardware

Manage Supply Chain

Track Quality

Automate with ION

Administration

API Reference

Authentication methods

Endpoint and headers

Troubleshooting

​Authentication methods

​Endpoint and headers

​Troubleshooting

​Related

Authentication methods

Endpoint and headers

Troubleshooting

Related