Skip to main content

Authentication

Every request to the public API is authenticated with an account API token. The token identifies your account and acts with administrator rights on it, so treat it like a password.

Getting a token​

API access is enabled per account by Deeper Signals. Once it is enabled, an account administrator creates the token under Settings → Integrations → API in the admin app. When the token is created you receive three values:

ValueUsed for
API tokenSent in the X-TOKEN header on every API call. Also the secret that signs SSO JWTs.
Client idThe client_id claim of an SSO JWT. Not needed for plain API calls.
Redirect domainsThe domains the SSO flow may redirect to on error (error_url). Ask Deeper Signals to add domains.

If you do not see the API section in the admin app, ask your Deeper Signals contact to enable API access.

Sending the token​

Put the token in the X-TOKEN header. The Authorization header is accepted as an alias.

curl https://api.deepersignals.com/api/external/users/columns \
  -H "X-TOKEN: $DS_API_TOKEN"

Requests without a valid token are answered with 401:

{ "code": 401, "message": "No API token provided." }

Scope of a token​

  • A token is bound to one account. It can only read and write users, teams, campaigns and reports of that account.
  • It is stateless: there is no session or refresh step.
  • It does not expire. Rotate it by creating a new token in the admin app and deleting the old one.

Keep it secret​

  • Call the API from your backend. Never ship the token in a browser, mobile app or spreadsheet macro.
  • Sign SSO JWTs on your server for the same reason.
  • If a token leaks, revoke it immediately in the admin app; every integration using it must then switch to the new one.