Skip to main content
Every request to tenant-scoped endpoints must be authenticated. The API supports three independent methods on the same endpoints: a GetDialed API key, a Clerk organization JWT, and a Clerk user API key.

API key

Pass your key in the X-API-Key header:
Keys are issued per organization. Only active accounts are accepted.

Bearer token (Clerk JWT)

If your organization uses Clerk-based sign-in, pass the organization JWT instead:
The token must be an RS256-signed Clerk organization token. The organization in the token determines your tenant scope, exactly as an API key would. Mutating endpoints (create, update, delete, trigger) additionally require an admin role in the organization.
If both headers are present on one request, the API key takes precedence. Use one method or the other.

Bearer token (Clerk user API key)

Clerk can also issue long-lived user API keys for machine-to-machine access. Unlike the organization JWT, a Clerk user API key is an opaque token — not a JWT: it carries no self-contained claims and is verified server-side against Clerk on every request. Pass it in the same Authorization: Bearer header:
The API detects that the token is a Clerk API key (rather than a JWT), verifies it directly with Clerk, and derives your tenant scope from the key’s Clerk-provisioned organization and role claims. As with the other methods, only active accounts are accepted, and mutating endpoints (create, update, delete, trigger) still require an admin role in the organization.
This method depends on a Clerk secret key being configured for the deployment. When it is not configured, requests using a Clerk API key receive a 503 (see the error table below). The organization JWT and X-API-Key methods are unaffected.

Public endpoints

Catalog (/catalog/*) and template (/flows/templates/*) endpoints are public and require no authentication.

Errors

Clerk user API key errors

Requests authenticated with a Clerk user API key can return the following, with the response detail set to the message shown: