Authentication

You can authenticate with the Appfigures API in two ways. Pick the one that fits the kind of app you’re building.

• Personal Access Tokens: (recommended) This is the simplest way to authenticate. Use it if you only need data from your own account, such as pulling data into an ETL or an internal dashboard. You generate a token in your Appfigures account and send it with every request.
• OAuth 2.0: A widely used standard that takes more work to implement correctly. You must use it if you’re building a client or package for other Appfigures users. For example, a mobile app that lets people log in to their own Appfigures accounts and see their data must use OAuth 2.0.

Setting Up an API Client

Every request to the API is tied to an API Client. Create one on the My API Keys page in your Appfigures account. It gives you the client_key and secret_key for your app. Every authentication method needs at least the client_key.

Identify Your App with a User-Agent

Send your app’s name in the User-Agent header of every request. The name can be any string you choose.

Authentication Errors

The API returns these errors when it can’t authenticate a request.

No API Access - Locked Account

You’ll get this when an account is suspended because of a billing issue:

HTTP 403 FORBIDDEN

{
    "status": 403,
    "message": "No API Access",
    "additional": "The authenticated account is locked due to an unpaid balance."
}

You can show the user a direct link to make a payment: https://appfigures.com/account/billing

API Access Is Disabled

You’ll get this when a user is suspended for violating the API terms:

HTTP 403 FORBIDDEN

{
    "status": 403,
    "message": "API Access is disabled",
    "additional": "API access has been disabled for this user due to API terms violation."
}

To resolve a terms violation, contact us.