Authentication

The eAgenda API uses Bearer Token authentication. This guide explains how to obtain and use your token securely.

Bearer Token (recommended for integrations)

Bearer Token authentication is the standard method for all API integrations.

How it works

Each request must include the Authorization header with your token:

Authorization: Bearer YOUR_TOKEN

How to obtain the token

1. Log in to the eAgenda dashboard
2. Go to Settings > Integrations > API
3. Click Generate API Token
4. Copy the generated token — it will only be shown once

Important: Keep your token in a safe place. Never expose it in public source code or in your application’s frontend.

Practical example

curl -X GET https://eagenda.com.br/api/v3/accounts/ \
  -H "Authorization: Bearer YOUR_TOKEN"

Most HTTP libraries make it easy to send the token:

Python:

import requests

response = requests.get(
    "https://eagenda.com.br/api/v3/accounts/",
    headers={"Authorization": "Bearer YOUR_TOKEN"}
)
print(response.json())

JavaScript (Node.js):

const response = await fetch("https://eagenda.com.br/api/v3/accounts/", {
  headers: {
    "Authorization": "Bearer YOUR_TOKEN"
  }
});
const data = await response.json();

PHP:

$ch = curl_init("https://eagenda.com.br/api/v3/accounts/");
curl_setopt($ch, CURLOPT_HTTPHEADER, [
    "Authorization: Bearer YOUR_TOKEN",
]);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
$response = curl_exec($ch);
$data = json_decode($response, true);

C# (.NET):

using var client = new HttpClient();
client.DefaultRequestHeaders.Authorization =
    new System.Net.Http.Headers.AuthenticationHeaderValue("Bearer", "YOUR_TOKEN");

var response = await client.GetAsync("https://eagenda.com.br/api/v3/accounts/");
var json = await response.Content.ReadAsStringAsync();

Authentication error responses

Code	Meaning	Action
401 Unauthorized	Invalid or missing token	Check your access token
403 Forbidden	No permission for the resource	Check account permissions

Example 401 error

{
  "detail": "Authentication credentials were not provided."
}

Security best practices

1. Never expose the token in the frontend — Use the API only in server-side (backend) code
2. Use environment variables — Store the token in environment variables, never hardcoded
3. HTTPS required — All requests must use HTTPS
4. Rotate tokens — Generate new tokens periodically
5. Principle of least privilege — Use accounts with only the necessary permissions

Example with environment variables

import os
import requests

response = requests.get(
    "https://eagenda.com.br/api/v3/accounts/",
    headers={"Authorization": f"Bearer {os.environ['EAGENDA_TOKEN']}"}
)

# .env (never commit this file!)
EAGENDA_TOKEN=your_access_token