API Authentication

All API requests to SilentShield require authentication. There are two authentication methods depending on the endpoint.

API Key Authentication

Most endpoints use API key authentication via the X-Api-Key header. Your API key is available in the dashboard under API Keys.

X-Api-Key: your-api-key-here

Use this method for: Widget endpoints, nonce verification, and public-facing API calls.

JWT Authentication

Dashboard and management endpoints use JWT (JSON Web Token) authentication. Obtain a token by logging in via the auth endpoint.

POST /api/v1/auth/login

Request Body:

{"email": "[email protected]", "password": "your-password"}

Response:

{"token": "eyJhbGciOiJIUzI1NiIs...", "expiresIn": 86400}

Authorization: Bearer eyJhbGciOiJIUzI1NiIs...

Use this method for: Management endpoints, analytics queries, team management, and account settings.

Authentication Errors

Status	Error	Solution
`401`	`missing credentials`	Add the X-Api-Key or Authorization header.
`401`	`invalid_api_key`	Check that your API key is correct and active.
`401`	`token_expired`	Your JWT has expired. Request a new token via /api/v1/auth/login.
`403`	`insufficient_permissions`	Your role does not have access to this endpoint.

Rate Limits

API requests are rate-limited per API key and endpoint. How many requests per minute you may make depends on your plan — the values are on the pricing page. Every response carries the rate-limit headers.

X-RateLimit-Limit
X-RateLimit-Remaining
X-RateLimit-Reset
Retry-After (only on 429)