Support Station

Authentication

You'll need to authenticate your requests to access any of the endpoints in the Support Station API. In this guide, we'll look at how authentication works using API keys.

API Keys

All API requests require authentication using an API key. Include your API key in the Authorization header as a Bearer token:

Example request with API key

curl https://api.supportstation.io/api/v1/tickets \
  -H "Authorization: Bearer sk_live_your_api_key_here"

Never expose your API keys in client-side code or commit them to version control. Always keep your API keys secure and rotate them if you suspect they have been compromised.

Creating API Keys

API keys are organization-scoped and can be created in your Support Station dashboard under Settings > API Keys.

  1. Navigate to Settings > API Keys
  2. Click "Create API Key"
  3. Give your key a descriptive name
  4. Select the permission scopes you need
  5. Copy the key immediately - it won't be shown again

Scopes

API keys have granular permission scopes that control what resources they can access:

  • Name
    tickets:read
    Description

    List and view tickets in your organization.

  • Name
    tickets:write
    Description

    Create tickets, update ticket properties, and add messages to tickets.

  • Name
    customers:read
    Description

    List and view customer information.

  • Name
    customers:write
    Description

    Create, update, and delete customers.

  • Name
    tags:read
    Description

    List and view tags in your organization.

  • Name
    tags:write
    Description

    Create, update, and delete tags.

  • Name
    webhooks:read
    Description

    List webhooks and view delivery history.

  • Name
    webhooks:write
    Description

    Create, update, and delete webhooks.

  • Name
    billing:read
    Description

    View usage and billing information.

When creating an API key, only select the scopes your integration actually needs. This follows the principle of least privilege and limits potential damage if a key is compromised.

Key Prefix

API keys start with sk_live_. The API does not accept sk_test_ keys or provide a separate test environment. Use a separate organization for test data.

You can also send the key in the X-API-Key header:

curl https://api.supportstation.io/api/v1/me \
  -H "X-API-Key: sk_live_your_api_key_here"

Rate Limiting

The current REST API does not define a fixed per-key request limit or X-RateLimit-* response headers. If a request returns HTTP 429, wait before you retry.

Security Best Practices

  • Never expose API keys in client-side code - API keys should only be used server-side
  • Use environment variables - Store API keys in environment variables, not in code
  • Rotate keys periodically - Create new keys and revoke old ones regularly
  • Use minimal scopes - Only request the permissions your integration needs
  • Monitor usage - Check your API key usage in the dashboard for unusual activity
GET/api/v1/me

Check your API key

Returns the organization and key details. This route requires a valid API key but no specific scope.

curl https://api.supportstation.io/api/v1/me \
  -H "Authorization: Bearer sk_live_your_api_key_here"

{
  "data": {
    "organization_id": "organization-uuid",
    "organization_name": "Acme",
    "organization_slug": "acme",
    "api_key_name": "CRM integration",
    "scopes": ["tickets:read"]
  }
}

The name and slug fields can be null.

Was this page helpful?