Get started

# Authentication

One scheme: a bearer token in the `Authorization` header. There is no OAuth flow, no request signing, and no query-string key.

```js
Authorization: Bearer fk_live_9Qb2vX7mR4tE1sYw8Kp3Dn6Lz0Hc5Ja
```

## Scope

A token identifies exactly one company. Every list is filtered to that company and every write lands inside it — you never pass a company id. Asking for a resource that belongs to someone else returns 404, not 403, so an id from another account is indistinguishable from one that does not exist.

## Administrator-only operations

A few operations check the caller's role rather than just the company. `GET /v1/users/{userId}` is administrator-only and returns 403 otherwise. `GET /v1/users` works for everyone but omits email addresses unless the caller is an administrator — so an integration that needs emails needs an administrator's key. Webhooks are administrator-only across the board: every operation on subscriptions and deliveries returns 403 unless the token's user is an administrator.

## When it fails

Status Meaning
401 Missing, malformed, or expired token.
403 Authenticated, but the operation needs a company administrator.
404 The id does not exist *in your company*. Also what you get for a quote id on an order endpoint.

## Handling keys

- Server side only. A key in client code is a key you have published.

- One key per integration, so you can revoke one without breaking the rest.

- Rotate by creating the new key, deploying, then deleting the old one. Both work during the overlap.

- A deleted key stops working immediately and every call with it returns 401.

---

Source: https://developer.factory.app/authentication · Factory Sales API v1