Authentication

The Easol API authenticates with a bearer token. Pass your API key in the Authorization header on every request:

curl https://api.myeasol.com/reports \
  -H "Authorization: Bearer YOUR_API_KEY"

Each key is issued for one company and reaches that whole company's data; there is no narrower per-user or per-device key. You can create as many keys as you like — one per integration is a good habit, since the name you give a key is how you tell them apart and how you decide which to revoke — but the name does not divide what a key can reach. Any key on a company can do anything the API offers for that company, with one exception: reporting, where a key reads only the reports selected for it (see Reporting access below). Keep your key secret, never expose it in client-side code, and make every request over HTTPS. A request with a missing or invalid key returns 401 (see Errors).

Endpoint pages do not repeat these authentication rules, but their code examples and Test panels still include the Authorization header so requests are complete.

Don't have a key yet? See Get your API key.

Basic auth

For convenience the key can also be sent as the username in HTTP Basic Auth, with no password. This applies to the reporting endpoints (/reports, /reports/runs, /reports/files):

curl https://api.myeasol.com/reports -u YOUR_API_KEY:

The trailing colon stops cURL prompting for a password.

If you call a reporting endpoint without credentials, the response is 401 with a WWW-Authenticate: Basic realm="Application" header and a plain-text body (HTTP Basic: Access denied.), not the JSON error envelope. Browsers may show a credentials dialog for that challenge. Integrations endpoints return the standard JSON envelope instead — see Errors.

Reporting access

Reporting endpoints follow the same authentication rules above, but access is narrower than company-wide: a key only sees reports granted to it, and only its own report runs. See Fetching report data.