Skip to main content

​
Overview

Every Forerunner API request needs a Bearer token in the Authorization header. The token identifies your account, scopes every response to your data, and records the request in our audit trail.

​
Getting your API key

API keys are issued per account and per environment, so a staging key does not work against production. To obtain one:
1

Contact your Customer Success Manager

Reach out to your Customer Success Manager to request API access.
2

Or email our team

Send a request to engineering@withforerunner.com with your account name and use case.
3

Receive your API key

You’ll receive a long-lived API key that can be used for all API requests.

​
Using your API key

Include your API key in the Authorization header of every request. A successful response confirms the key is configured correctly:
cURL

​
API key lifecycle

API keys are long-lived but may be rotated for security reasons. Always store API keys securely and be prepared to update your integration if notified of an API key rotation.

​
API key security best practices

  • Never commit API keys to version control
  • Use environment variables or secure secret management systems
  • Rotate API keys periodically as a security best practice
  • Only share API keys with authorized team members - Use separate API keys for different environments when possible - Monitor API usage for unexpected patterns
  • Implement proper error handling for 401 Unauthorized responses
  • Log authentication failures for security monitoring
  • Have a process to quickly rotate compromised API keys

​
Authentication errors

A 401 body is plain text, not the JSON errors array the rest of the API returns.