Skip to main content

​
Authentication

ItsFriday uses API keys and OAuth 2.0 for authentication.

​
API Keys

API keys are used for server-to-server communication.

​
Creating an API Key

  1. Navigate to Settings > API Keys in the dashboard
  2. Click Create API Key
  3. Give it a name and select permissions
  4. Copy and store the key securely
API keys are shown only once. Store them securely - you cannot retrieve them later.

​
Using API Keys

Include the API key in the Authorization header: 
curl https://api.itsfriday.in/v1/metrics/ \
  -H "Authorization: Bearer if_live_abc123..."

​
Key Prefixes

PrefixEnvironment
if_live_Production
if_test_Test/Development

​
Key Permissions

PermissionAccess
readQuery data
writeSend data
adminManage settings

​
OAuth 2.0 (Auth0)

For user authentication and the dashboard, we use Auth0.

​
Configuration

Set these environment variables: 
AUTH0_DOMAIN=your-tenant.auth0.com
AUTH0_AUDIENCE=https://api.itsfriday.in
AUTH0_CLIENT_ID=your-client-id
AUTH0_CLIENT_SECRET=your-client-secret

​
Getting an Access Token

curl -X POST https://your-tenant.auth0.com/oauth/token \
  -H "Content-Type: application/json" \
  -d '{
    "client_id": "YOUR_CLIENT_ID",
    "client_secret": "YOUR_CLIENT_SECRET",
    "audience": "https://api.itsfriday.in",
    "grant_type": "client_credentials"
  }'
Response: 
{
  "access_token": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9...",
  "token_type": "Bearer",
  "expires_in": 86400
}

​
Using the Token

curl https://api.itsfriday.in/v1/metrics/ \
  -H "Authorization: Bearer eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9..."

​
Multi-Tenant Access

Each request is scoped to the tenant associated with the API key or token. The tenant ID is extracted from:
  1. API key association
  2. org_id claim in JWT token
  3. X-Tenant-ID header (admin only)

​
Security Best Practices

Create new keys and deprecate old ones every 90 days.
Never use production keys in development.
Use environment variables or secret managers. Never commit keys to git.
Only grant permissions that are actually needed.

​
Troubleshooting

  • Check if the API key is valid
  • Verify the key has correct permissions
  • Ensure Bearer prefix is included
  • The key doesn’t have required permissions
  • Trying to access another tenant’s data
  • OAuth tokens expire after 24 hours
  • Request a new token using client credentials