View as Markdown

Client API

Authentication #

The Satori Client API authenticates with an API key.

Requests follow two steps:

  1. Authenticate. Call POST /v1/authenticate with your API key passed as the username in an HTTP Basic Authentication header and an empty password. The response returns a session token and a refresh token.
  2. Call the API. Send the session token as a Bearer credential in the Authorization header on every other endpoint.

See client libraries for concrete code examples.

Two endpoints differ from the pattern above:

  • GET /v1/flag and GET /v1/flag/override accept either an API key or a session token. The reference shows both as required. Only one is needed.
  • POST /v1/server-event uses Basic Authentication with an API key. See Server events.