Authentication

All 3Common REST API requests are authenticated with a bearer token in the Authorization header.

Authorization: Bearer YOUR_API_KEY

If you omit the header or pass an invalid token, the API responds with 401 Unauthorized.

Getting an API key

1. Sign in to the 3Common dashboard.
2. Open Settings → API keys.
3. Click Create key, give it a descriptive name, and copy the token.

Tokens are shown once at creation time. Store the secret in a password manager or a secret store (Vault, Doppler, AWS Secrets Manager). Never commit it to a public repository or paste it into client-side code.

Rotating keys

To rotate a key:

1. Create a new key in the dashboard.
2. Deploy your application using the new key.
3. After confirming traffic on the new key, revoke the old one.

Revoking a key takes effect immediately. Any in-flight requests using the revoked key will start failing with 401 Unauthorized.