Authentication
Authenticate API requests with a bearer token; never expose secret keys in client code.
The Getme API authenticates requests with a bearer token sent in the Authorization header. A request without a valid token returns 401 Unauthorized.
curl https://api.getmeonline.io/v1/auth/status \
-H "Authorization: Bearer $GETME_API_KEY"
Auth modes
Different endpoints accept different credentials. Each endpoint in the reference shows its required auth mode and, where applicable, a required scope.
- App install bearer — a token issued to an installed app, used for most resource endpoints.
- Device authorization — the public device-authorization flow used to obtain a token (see the Auth resource for the exact endpoints).
When an endpoint lists a required scope, the token must carry that scope or the request returns 403 Forbidden.
Test and live tokens
App-install access tokens are environment-scoped:
gmat_test_...
gmat_live_...
Use gmat_test_* tokens for staging and test-workspace automation. Use gmat_live_* tokens only for production workspaces and production data. Keep test and live webhook endpoints, secrets, and CI variables separate.
The production API host expects live tokens. The staging API host expects test tokens. Developer test workspaces cannot create or rotate live app-install tokens.