Authentication - ION Manual

Authentication methods

The ION GraphQL API supports two authentication methods: API keys for machine-to-machine integrations and OAuth 2.0 for user-facing applications. Both methods use your region’s API endpoint and the same Authorization header. Only the way you obtain the token differs.

Endpoint and headers

Include the access token on every request. Host is your region’s API endpoint. For the endpoint that matches your app URL, see Getting started.

POST /graphql HTTP/1.1
Host: api.buildwithion.com
Authorization: Bearer <token>
Content-Type: application/json

ION also accepts Authorization: Token <token> for backward compatibility. Prefer Bearer. For multipart file uploads, set Content-Type: multipart/form-data. Follow the flow in File Upload.

Troubleshooting

When ION rejects a request during authentication, the response carries an errors[].message payload:

{
  "errors": [{ "message": "Token is expired." }]
}

For the full list of authentication failures and their fixes (401 Unauthorized, 403 Forbidden, rate limits, and 5xx errors), see Error codes.

⌘I