# Authentication

All requests to the Testpad API must include the Authorization HTTP Header that supplies an API access token for your account.

<br>

**HTTP Header**
<br>
<br>


The `Authorization` header value must have the format: `Authorization: apikey <TOKEN>`

The token must be preceded by the prefix `apikey` to be considered a valid authorization value. It is envisaged that alternative authorization schemes may be added in the future, and these would be differentiated with a different prefix.

<br>

**API Access Token**
<br>
<br>

Create and manage API Access Tokens on the API settings page in the Testpad app (account Owners only).

The API settings page is found in the Settings section of the navigation links in the bottom left of the main project view.

If you cannot see a link to API settings (and you are an account Owner), then your account probably has not yet been enabled for API access – please contact support@testpad.com to request access.

<br>

**Enabling API access**

API access is off by default. Two things must both be true for any request to succeed:

1. Your account must have the API feature switched on by Testpad. Until then, every request returns `403 Forbidden` with `{"error": "The API is not available for this account."}` — contact support@testpad.com to request access.
2. An account Owner must turn API Access on for the account (on the API settings page). While it is off, every request returns `403 Forbidden` with `{"error": "API access is turned off for this account."}`.

A request with a missing, malformed, expired, deleted or disabled token returns `401 Unauthorized` instead.

Security notes:

- Tokens are 64-character case-sensitive strings of letters and digits (a-z, A-Z, 0-9).  
- Tokens are generated by Testpad using a cryptographically-strong random number generator.
- An account may generate and make use of multiple tokens, e.g. to give different teams different tokens.
- For now, the API is secured with tokens that grant access to all API capabilities and across all projects. It is expected that more fine-grained control such as role-specific and project-specific access keys will be supported in the future.


## Identify the caller

 - [GET /whoami](https://api-docs.testpad.com/openapi/authentication/paths/~1whoami/get.md): Returns the account and API key associated with the supplied token. Useful as a connectivity and authentication check.