Introduction

Authentication

All requests to Inworld's APIs carry a credential in the Authorization header — your API key directly on servers, or a token minted from it (a one-time token; session tokens are deprecated) on clients:

Authorization: Basic $INWORLD_API_KEY

The authentication guide covers how to choose a credential, and Security best practices covers keeping it safe.