Skip to main content

​
API keys

Authenticate every request with a bearer token:
API keys belong to an app on your account. Create apps and keys in the Customer Portal under Account Settings → Custom Apps:
  • Internal apps authenticate with sk- API keys and access your own account’s data. Most integrations want this.
  • Platform apps are OAuth applications for building on Fortis on behalf of other accounts, using the OAuth 2.0 authorization code flow. Platform app creation is enabled per account — contact support to get access.
You can view your keys at any time from the app’s details page in the portal. Revoke a key at any time; revoked keys stop working immediately.
Keep keys server-side. Never embed an API key in a browser, mobile app, or public repository.

​
Scopes

Every endpoint requires a scope. API keys have access to all scopes by default. A request missing a required scope returns 403:

​
Errors

​
Rate limits

Requests are limited to 120 per minute per API key. When you exceed the limit, the API returns 429 with a Retry-After header. If you need a higher limit, contact support.