Authentication
EDI API authentication
How SignalEDI platform API keys work: Bearer auth, platform vs workspace scopes, rotation, and rate-limit headers.
Quick answer
Which environment variable should I use?
SIGNALEDI_API_KEY is the conventional name across docs and samples. Store it in your secret manager — never commit live keys.
Bearer token pattern
Every /api/v1 request carries Authorization: Bearer <SIGNALEDI_API_KEY>. Missing or invalid keys return 401 without leaking tenant details.
Authorization: Bearer $SIGNALEDI_API_KEYScopes
Platform-scoped keys power developer integrations (/api/v1/*). Workspace-scoped keys remain tied to SMB dashboard flows.
- Platform scope → developer console + /api/v1
- Workspace scope → tenant dashboard APIs
Rate limits
Responses include X-RateLimit-Limit, X-RateLimit-Remaining, and X-RateLimit-Reset. Back off with jitter when you receive 429.
FAQ
Common questions
SIGNALEDI_API_KEY is the conventional name across docs and samples. Store it in your secret manager — never commit live keys.
Use separate keys per environment. Rotate production keys on a schedule and revoke compromised keys immediately.