User credentials
User credentials authentication is only needed temporarily for the two cross-Workspace operations listed below. These APIs are being updated to support application tokens. For all other API integrations, use application tokens.
User credentials authentication is currently required for:
MFA is required for all accounts except trial plans and can’t be disabled. If your account has MFA enabled, you must handle the multi-step MFA flow, which adds complexity to automated integrations.
Authenticate with user credentials
To authenticate, send a POST request to /api/v1/authenticate with your username (your email address) and a SHA-1 hashed password.
The response includes an auth_token and refresh_token.
Hash your password with SHA-1
The API requires your password to be SHA-1 hashed before sending. This is a legacy requirement for compatibility with existing integrations.
To generate a SHA-1 hash in your terminal:
The -n flag prevents a trailing newline, which would change the hash.
Don’t include quotes around your password in the actual command if your password contains special characters.
Refresh your auth token
After successful authentication, the server returns both an auth_token and a refresh_token.
Use the refresh token to obtain a new auth_token without re-entering your credentials.
Token expiration
The refresh_token can only be used once.
After you use it, the server issues a new refresh token with the new auth token.
The refresh token also becomes invalid if you log in from another client.
Handle expired tokens
When your auth_token expires:
- If your
refresh_tokenis still valid, use it to get a newauth_token - If both tokens have expired, authenticate again with your username and password
To avoid interruptions, refresh your token before it expires.
Consider refreshing when the auth_token has less than 30 minutes remaining.