intermediate6 minutes
Application API Authentication
How signed-in Tenders-SA browser workflows authenticate application API requests
Two Different API Surfaces
The routes documented in this section belong to the signed-in Tenders-SA web application. Browser authentication uses the secure HTTP-only session cookie created by login. The separate Developer API v2 uses managed API keys and is documented at Developer Portal.
Do not expose session tokens
Browser code must not read a session token from local storage or construct its own Authorization header. Send same-origin requests with credentials included and let the platform's secure cookie and middleware handle authentication.
Login and Registration
Use the platform's existing login and registration pages. Successful authentication sets the secure session cookie. Do not place passwords, cookies or API keys in URLs, logs, documentation examples or support messages.
Authenticated same-origin request
javascript
Developer API Keys
For programmatic access from your own server, script or application, create and manage a Developer API key at /dashboard/developer/api-keys. Follow the v2 reference and SDK guidance under /developers; do not reuse a browser session cookie as an integration credential.
Common Authentication Errors
| Status | Meaning |
|--------|---------|
| 400 | Invalid request body or parameters |
| 401 | No valid signed-in session |
| 403 | The account cannot access the requested company resource or capability |
| 429 | The applicable request limit was exceeded |
|--------|---------|
| 400 | Invalid request body or parameters |
| 401 | No valid signed-in session |
| 403 | The account cannot access the requested company resource or capability |
| 429 | The applicable request limit was exceeded |
Related Guides
See Account Setup, Documents API, Tenders API, or the separate Developer API v2 reference.