Authentication

All requests to the Golden Reports API must include a valid bearer token in the Authorization header.

Bearer tokens

Include your token in every request:

Authorization: Bearer YOUR_TOKEN

Tokens are scoped to a single user account and carry the same permissions as that user within the Golden Reports app.

Obtaining a token

Tokens do not expire by default but can be revoked at any time from the API Access settings page.

API keys

Dedicated API keys — independent of any user account, with configurable scopes and expiry — are on the roadmap. If this is blocking your integration, let us know.

Errors

If your token is missing or invalid, the API returns a GraphQL error:

{
  "errors": [
    {
      "message": "Unauthorized",
      "extensions": {
        "code": "UNAUTHENTICATED"
      }
    }
  ]
}

See Errors for the full error reference.