Authentication

Overview

All Origin Studio API requests require authentication using an API key.

API keys:

• Identify your client application

• Control access permissions

• Ensure secure communication with the API

All requests must include a valid API key in the Authorization header.

---

Obtain an API Key

API keys are issued by:

• Your Origin Studio administrator, or

• Fabric Support

If you do not have access, contact your administrator.

---

Generating an API Key (Admin Users)

If you are an administrator:

1. Navigate to the top-right corner of Origin Studio

2. Select Administrator or any roles you have set up in Security

3. Go to API Keys

4. Select Generate Key

5. Copy and securely store your API key

⚠️ API keys are sensitive credentials. Store them securely and do not share them publicly.

---

Using Your API Key

Include your API key in the Authorization header using the Bearer authentication scheme.

Format

Authorization: Bearer YOUR_API_KEY

Example

API Key

HUBHYH783200KLAC

Header

Authorization: Bearer HUBHYH783200KLAC

---

Example Request

curl https://api.studio.fabricdata.com/v1/records \
  -H "Authorization: Bearer HUBHYH783200KLAC"

Your API key must be included in every request.

---

Authentication Errors

---

401 Unauthorized

A 401 Unauthorized response indicates that authentication has failed.

Possible Causes

• Missing API key

• Invalid API key

• Revoked API key

• Expired API key (if applicable)

Resolution

• Verify your API key is correct

• Ensure the Authorization header is included

• Confirm the key has not been revoked

• Regenerate a new key if necessary

403 Access Denied

A 403 Access Denied response indicates that authentication has failed.

Possible Causes

• Incorrect API Key

Resolution

• Verify your API key is correct

---

Example Error Response

The Origin Studio API follows the JSON:API specification for error responses.

{
    "jsonapi": {
        "version": "1.1"
    },
    "errors": [
        {
            "status": "401",
            "title": "Unauthorized",
            "detail": "You are not authorized to perform this action."
        }
    ]
}

---

Security Best Practices

• Never expose API keys in frontend code

• Do not commit API keys to source control

• Store API keys in secure environment variables or a secrets manager

• Rotate API keys periodically

• Revoke compromised keys immediately