Authentication

Send your token in the Authorization header of every request:

curl "https://partner-api.getinline.tech/v1/ping" \
  -H "Authorization: Bearer $INLINE_API_TOKEN"

Use exactly Authorization: Bearer <token>: the word Bearer with a capital B, one space, then the token. Any other form returns 401 unauthorized.

We also recommend a User-Agent that names your product and version. It helps us find your requests when you ask for help.

A token belongs to one organization. It can never do more than a member of that organization can do in the dashboard.

Create a token#

Any member of your organization can create and revoke tokens in the dashboard under Organization > API tokens. For each token, you choose:

• A label, such as where the token runs, so you can tell tokens apart.
• Scopes.
• An expiry.

You see the full token once, when you create it. Inline cannot show it again. If you lose it, create a new token and revoke the old one. An organization can have up to 20 active tokens.

Token format#

inl_live_abcd1234_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

This example is a placeholder, not a working token.

Scopes#

GET /v1/ping works with any valid token. A request without the required scope returns 403 forbidden, and the message names the missing scope. We may add scopes later.

What a token can see#

A token sees only your organization's revenue. A publisher_id filter for a publisher outside your organization returns 404 not_found, the same as for a publisher that does not exist. Publishers added to your organization are included right away.

Expiry#

Pick an expiry when you create a token: 90 days, 6 months, 1 year (the default), 2 years, or never. GET /v1/ping returns it as token.expires_at, which is null for a token that never expires. An expired token returns 401 unauthorized. Rotate before it expires.

Rotate a token#

Two tokens can be active at once, so you can rotate with no downtime:

1. Create a new token with the same scopes.
2. Deploy it to your servers.
3. Call GET /v1/ping with the new token. Check that token.key_id is the new key ID.
4. Revoke the old token.

Revoke a token#

Revoke a token under Organization > API tokens. It stops working within five minutes. If a token leaks, revoke it right away and create a new one.

Every rejected token gets the same 401 unauthorized response, whether it is missing, malformed, unknown, revoked, or expired. The response does not say which.

Activity#

The dashboard lists token creation and revocation under Organization > Activity.

Keep tokens on the server#

The Partner API is for server-to-server calls. It sends no CORS headers, so browsers block calls to it from web pages.

• Never put a token in browser JavaScript, a mobile app, or a public repository.
• Store tokens in a secrets manager or an environment variable.
• Log the key ID, never the token.

Rate limits#

Over a limit, you get 429 rate_limited. If the response has a Retry-After header, wait that many seconds. Otherwise, back off exponentially with jitter. Some 429 responses are sent before the request reaches the API. They can have a different body and no X-Request-Id, so check the HTTP status, not the body. See retries.

A revenue sync needs far fewer requests than these limits. See how often to pull.