Authentication

Learn how to authenticate with the SIBI API

SIBI issues two kinds of tokens, one per API:

REST API tokens authenticate the REST APIs at https://api.sibipro.com. They are scoped, and the GraphQL API rejects them. See REST API Tokens.
GraphQL tokens — the tokens described on this page — authenticate the GraphQL API. They also still work on some REST endpoints, but that support is limited and going away; see GraphQL tokens on REST.

Obtaining an Access Token

You can retrieve your token from SIBI Developer Portal using your login credentials.

Once you have your token, include it in the Authorization header for all API requests:

Authorization: Bearer YOUR_ACCESS_TOKEN

Either kind of token can revoke itself by sending a DELETE request to /token with the token in the Authorization: Bearer header.

curl -X DELETE https://api.sibipro.com/token \
  -H "Authorization: Bearer YOUR_API_TOKEN"

A successful revocation returns a 204 No Content response. After revocation, the token can no longer be used to authenticate requests.