> ## Documentation Index
> Fetch the complete documentation index at: https://docs.answeringagent.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Partner API authentication

> How resellers authenticate with the Answering Agent Partner API.

## Overview

The Partner API is for reseller accounts that provision Answering Agent for their own customers. It manages organizations, users, locations, partner links, and embed tokens. It authenticates with an API key from your partner account.

The base URL is `https://answeringagent.com/api/v1`.

<Warning>
  The Partner API accepts keys from reseller accounts only. A key from a regular Answering Agent team gets `401` with `{"error": "Invalid credentials"}`. To read your own team's conversations, tasks, contacts, and reports, use the [Customer API](/api/overview).
</Warning>

<Note>
  This documentation covers the **Partner API** for building integrations. If you're looking to embed the Answering Agent dashboard in your application, see the [Embed Guide](/advanced/embed) after completing initial setup.
</Note>

***

## How Authentication Works

1. **Generate an API Key** from your Answering Agent partner dashboard
2. **Include the key** in the `X-API-KEY` header for every API request
3. **Access granted** - The API key identifies your partner account and provides access to your customer organizations

Requests are not signed and carry no timestamp. The key is the only credential, so keep it on your server and treat it like a password.

***

## Obtaining Your API Key

<Steps>
  <Step title="Sign in to your partner dashboard">
    Log in to the Answering Agent dashboard with your partner account credentials.
  </Step>

  <Step title="Navigate to API Keys settings">
    Go to **Settings → API Keys** in the dashboard navigation.
  </Step>

  <Step title="Generate a new key">
    Click **New API Token**, enter a token name, and click **Create**. The dashboard shows the key once, so copy it now.
  </Step>

  <Step title="Store securely">
    Save the key in your backend environment variables or secrets manager. Never expose it in client-side code.
  </Step>
</Steps>

<Warning>
  API keys are shown only once when created. If you lose a key, you'll need to generate a new one and update your integration.
</Warning>

A key looks like `123|AbCdEf0123456789...`: a number, a `|`, and a secret. Send the whole string.

<img src="https://mintcdn.com/answeringagent/r3cbDc_5SaGGF_HO/images/api-keys.png?fit=max&auto=format&n=r3cbDc_5SaGGF_HO&q=85&s=f19b2c64a12a520a944c00adabd6219f" alt="API Keys" width="3488" height="2002" data-path="images/api-keys.png" />

***

## Using Your API Key

Include your API key in the `X-API-KEY` header for every request to the Partner API:

<Tabs>
  <Tab title="cURL" value="curl" default>
    ```bash theme={null}
    curl -X GET "https://answeringagent.com/api/v1/organizations" \
      -H "X-API-KEY: 123|AbCdEf0123456789AbCdEf0123456789AbCdEf01234" \
      -H "Content-Type: application/json"
    ```
  </Tab>

  <Tab title="JavaScript" value="javascript">
    ```javascript theme={null}
    const res = await fetch('https://answeringagent.com/api/v1/organizations', {
      headers: {
        'X-API-KEY': process.env.ANSWERING_AGENT_API_KEY,
        'Content-Type': 'application/json',
      },
    });
    if (!res.ok) throw new Error(`${res.status}: ${await res.text()}`);
    const organizations = await res.json();
    ```
  </Tab>
</Tabs>

### Required Header

<ParamField header="X-API-KEY" type="string" required>
  Your API key from the partner dashboard. All partner API endpoints require this header.
</ParamField>

***

## Response Codes

| Status | Meaning | Typical Cause |
| - | - | - |
| 200/201 | Success | Request completed successfully |
| 401 | Unauthorized | Missing or invalid `X-API-KEY` header, or a key from an account that is not a reseller |
| 403 | Forbidden | API key valid but lacks permission for this resource |
| 404 | Not Found | Resource doesn't exist or doesn't belong to your partner account |
| 405 | Method Not Allowed | The endpoint does not support that HTTP method |
| 422 | Validation Error | Request data is invalid or incomplete |
| 429 | Too Many Requests | Partner link invites and updates allow 10 requests per minute. Wait for `Retry-After` seconds. |
| 500 | Server Error | Unexpected error on our side - contact support |

Authentication errors return `{"error": "..."}`: `API key is required` when the header is missing, and `Invalid credentials` otherwise. Other errors return `{"message": "..."}`. A `422` also includes `errors`, keyed by field.

***

## Understanding Token Types

Answering Agent uses different authentication methods for different purposes. As a partner integrator, you only need to worry about **API Keys**.

| Token Type | You Need This For | How to Get It |
| - | - | - |
| **API Key** | Managing customer organizations via Partner API | Dashboard → Settings → API Keys |
| **Embed Token** | Embedding dashboards in your application | API endpoint `/api/v1/users/{external_id}/embed-token` |

***

## Example Integration

Here's a complete example of authenticating and creating your first customer organization:

<Tabs>
  <Tab title="cURL" value="curl" default>
    ```bash theme={null}
    # Store your API key securely
    API_KEY="123|AbCdEf0123456789AbCdEf0123456789AbCdEf01234"
    BASE_URL="https://answeringagent.com/api/v1"

    # Create a customer organization with owner
    curl -X POST "${BASE_URL}/organizations" \
      -H "X-API-KEY: ${API_KEY}" \
      -H "Content-Type: application/json" \
      -d '{
        "name": "Acme Corporation",
        "description": "A technology company",
        "owner": {
          "external_id": "user_123",
          "email": "john@acme.com",
          "name": "John Doe"
        }
      }'
    ```
  </Tab>

  <Tab title="JavaScript" value="javascript">
    ```javascript theme={null}
    const API_KEY = process.env.ANSWERING_AGENT_API_KEY;
    const BASE_URL = 'https://answeringagent.com/api/v1';

    async function createOrganization(orgData) {
      const response = await fetch(`${BASE_URL}/organizations`, {
        method: 'POST',
        headers: {
          'X-API-KEY': API_KEY,
          'Content-Type': 'application/json'
        },
        body: JSON.stringify(orgData)
      });

      if (!response.ok) {
        throw new Error(`API error: ${response.status}`);
      }

      return response.json();
    }

    // Usage
    const result = await createOrganization({
      name: 'Acme Corporation',
      description: 'A technology company',
      owner: {
        external_id: 'user_123',
        email: 'john@acme.com',
        name: 'John Doe'
      }
    });

    console.log('Organization created:', result.organization);
    console.log('Owner user:', result.owner);
    ```
  </Tab>
</Tabs>

***

## Security Best Practices

| Practice | Why It Matters |
| - | - |
| **Never expose keys in client code** | API keys grant full access to your partner account. Keep them server-side only. |
| **Use environment variables** | Store keys in `.env` files or secrets managers, never in source code. |
| **Rotate keys periodically** | Generate new keys every 6-12 months to limit exposure risk. |
| **Use separate keys per environment** | Different keys for development, staging, and production isolate issues. |
| **Revoke compromised keys immediately** | If a key is exposed, revoke it in the dashboard and generate a new one. |
| **Monitor API usage** | Watch for unexpected patterns that might indicate unauthorized access. |

***

## Frequently Asked Questions

<AccordionGroup>
  <Accordion title="Can I use the same key for multiple environments?">
    While technically possible, we recommend generating separate API keys for development, staging, and production environments. This makes it easier to rotate keys and debug issues without affecting production traffic.
  </Accordion>

  <Accordion title="What happens if my API key is compromised?">
    Immediately revoke the compromised key in **Settings → API Keys** and generate a new one. Update your integration with the new key. The old key will stop working immediately after revocation.
  </Accordion>

  <Accordion title="Can I expose my API key in client-side JavaScript?">
    No! API keys should only be used from your backend servers. Exposing them in browser JavaScript would allow anyone to access your partner account and manage your customer organizations.
  </Accordion>

  <Accordion title="Do I need to sign my requests with HMAC or timestamps?">
    No. Simply include your API key in the `X-API-KEY` header. No additional signing or cryptographic operations are required.
  </Accordion>

  <Accordion title="What if I need to give customers access to their dashboard?">
    Use embed tokens! After creating a customer organization, retrieve an embed token for the owner user and embed our dashboard in your application. See the [Embed Guide](/advanced/embed) for details.
  </Accordion>

  <Accordion title="Can I have multiple API keys active at once?">
    Yes! You can generate multiple API keys and they will all work simultaneously. This is useful for key rotation (generate new key, update systems, then revoke old key) or for different services.
  </Accordion>
</AccordionGroup>

***

## Next Steps

Now that you understand authentication, you're ready to start building your integration:

<CardGroup cols={2}>
  <Card title="Organizations" icon="building" href="/partner-api/organizations">
    Create and manage customer organizations
  </Card>

  <Card title="Users" icon="users" href="/partner-api/users">
    Add users to organizations
  </Card>

  <Card title="Locations" icon="map-pin" href="/partner-api/locations">
    Set up phone numbers and locations
  </Card>

  <Card title="Quickstart Guide" icon="rocket" href="/partner-api/quickstart">
    Build your first integration in 5 minutes
  </Card>
</CardGroup>

***

## Support

If you have questions about authentication or need help with your integration:

* **Email**: [support@answeringagent.com](mailto:support@answeringagent.com)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.