Skip to main content
Every request requires a Passionfroot API key in the HTTP Authorization header.
Create keys from Settings → API. While the Creator API is in alpha, creator accounts need approved access first. Give each integration its own key and the shortest practical expiration date. Because the full value is displayed only once, store it in a secret manager as soon as it is created. Keys inherit the account that created them:
  • Partner keys can access only the partner organization’s permitted data.
  • Creator keys can access only that creator account’s data.
  • A resource that exists but is outside the key’s account is generally returned as 404, so the API does not disclose its existence.
Revocation takes a couple of minutes to propagate, so treat a leaked key as live until then. Rotate a key by creating its replacement, updating the integration, verifying traffic, and then revoking the old key.

​
Authentication failures