Authentication
Every API request is authenticated with an API type token, sent in the token header. The token identifies your Account: everything run with it happens in that Account.
Generate the token
Open the tokens screen
In Sinfonia, go to Administration → Tokens and click + Token.
Fill in the fields
Enter a Label that identifies the integration (for example, erp-billing) and choose the API type.
Copy the value
Click the icon next to the token to copy it and store it somewhere safe, such as a secrets vault.
See the screen details in Tokens.
Send the token
Include the token header in every request:
curl -X GET "https://sinfonia.live/api/v1/execlog/4512" \
-H "token: YOUR_TOKEN"If the header is missing or the token is invalid, the API responds with 401 Unauthorized.
Best practices
- One token per integration. Executions triggered through the API show up on the platform as created by
api_<label>, so a clear label shows which system triggered each execution. It also lets you revoke a single integration. - Never expose the token in the browser or in apps. Make the calls from your server.
- Don’t hard-code the token. Use environment variables or a secrets vault. Sinfonia’s Environment Variables are for your bots, not for external systems.
- Revoke unused tokens. To remove a token, use the trash icon on the Tokens screen.
Warning
The token can run any bot in the Account. Treat it like a password.
Last updated on