Every integration request is authenticated against a user, using that user's API key. Requests also need your Brand ID, which is part of the endpoint path.
Finding your Brand ID and API key
Open the admin pages (your profile menu, top-right → Admin) and go to the User page. Under API Access you'll find your Brand ID and your API key, each with a copy button, ready to drop into your integration.
There's no self-service way to regenerate a key from this page — if a key needs rotating, contact your Resourced contact.
Ways to authenticate
There are three ways to authenticate a request:
HTTP header — send your key as the x-api-key header. This is the recommended approach for automated integrations.
Query string — add api-key as a query parameter (handy for quick manual tests).
Logged-in session — when signed in to the system in a browser, you can call an endpoint by pasting its path into the address bar. Useful for manual testing only, not for automated integrations.
The same key works in both Production and QA, since QA is refreshed from a copy of Production — so an integration built against QA keeps working when you point it at Production. The endpoint paths and Swagger reference are covered in The integration API: overview.
💡 Treat your API key like a password — don't commit it to source control or share it in tickets.