Authentication

The 3Rings API authenticates with a secret API key, passed as a bearer token on every request:

curl https://api.3ringscapital.co/v1/businesses \
  --header 'Authorization: Bearer 3r_live_•••'

Key types

Prefix	Environment	Base URL
`3r_test_`	Sandbox — safe, isolated test data	`https://api-sandbox.3ringscapital.co`
`3r_live_`	Production — real books	`https://api.3ringscapital.co`

Keys are issued per partner from the dashboard. A partner can hold several keys (for example, one per environment or per deployment) and rotate them independently.

A secret key can read and write every business under your partner account. Keep it on your server, store it in a secret manager, and never expose it in browsers, mobile apps or public repositories. If a key leaks, rotate it from the dashboard immediately.

Errors

A missing, malformed or revoked key returns 401 Unauthorized:

{
  "error": {
    "type": "unauthorized",
    "message": "Missing or invalid API key.",
    "code": "auth.invalid_key"
  }
}

See Errors for the full error model.

Roadmap: OAuth2 for partners

Secret keys are the first authentication method. A full OAuth2 client-credentials flow — with scoped tokens per integration — is on the roadmap for partners who need finer-grained access.

Get started

Core concepts

Guides

Authentication

Key types

Errors

Roadmap: OAuth2 for partners

​Key types

​Errors

​Roadmap: OAuth2 for partners

Key types

Errors

Roadmap: OAuth2 for partners