Authentication

Some API endpoints require authentication to work. This section explains how to make authenticated HTTP Requests to Fider.

The first step is to generate an API Key on your user profile. Sign in on Fider, open My Settings (/settings), and in the API Key section click on Regenerate API Key. An API Key will be shown. Take note of it as you won't be able to retrieve this key again. If your Key is lost or has been compromised, you can always repeat this process to generate a new Key. Generating a new Key invalidates the previous one.

API Keys can only be used by users with the Collaborator or Administrator role. The API Key section is not shown to Visitors, and a Key that belongs to a user who is no longer a Collaborator or Administrator is rejected.

With the API Key on hand, you can send authenticated requests to the API using the Authorization HTTP Header as shown below.

Authorization: Bearer {api-key}

API Keys are only accepted on /api/ endpoints. If the Key is not valid, the request fails with 400 Bad Request and the error message API Key is invalid. If the user that owns the Key is blocked, the request fails with 401 Unauthorized.

Private sites

On a private site, every endpoint requires authentication, including the endpoints marked as Authentication: Optional in this documentation. Unauthenticated requests are redirected to the sign in page.

Impersonation

Every action performed via the API is executed under the User that generated the API Key. Fider also allows Administrators to impersonate another User and execute the operations on their behalf. To do so, add the following HTTP Header to the request.

Authorization: Bearer {api-key}
X-Fider-UserID: {target-user-id}

When impersonating, the request is executed with the role and permissions of the target user. For example, an endpoint that requires the Collaborator role will fail with 403 Forbidden if the target user is a Visitor.

The request fails with 400 Bad Request if the API Key doesn't belong to an Administrator, or if no user with the given ID exists on the site.

Roles

Fider has 3 user roles: visitor, collaborator and administrator. These roles are used to restrict which actions each user can perform on the platform, be it via UI or via the API. Most operations can only be executed if the authenticated user has a specific role assigned. Every operation in this documentation specifies which role is required.