API Authentication

API keys, OAuth 2.0, JWT tokens, and rate limiting for Pet360 integrations.

Authentication Methods

Method	Format	Usage	Security
API Key	pk_live_...	Server-to-server	Secret, rotate regularly
Bearer Token	eyJhbGc...	OAuth 2.0 flows	Short-lived, refresh
Webhook Signature	sha256=...	Verify inbound webhooks	HMAC validation

# HTTP Header

X-API-Key: pk_live_abc123def456...

# cURL Example

curl -X GET "https://api.pet360.app/v1/animals" \
  -H "X-API-Key: pk_live_abc123def456" \
  -H "Content-Type: application/json"

Request only the scopes your integration needs. Principle of least privilege.

Scope	Description
animals:read	Read animal records
animals:write	Create/update animals
medical:read	Read medical records
medical:write	Create/update medical records
financial:read	Read transactions, donations
financial:write	Create transactions
people:read	Read person records
people:write	Create/update persons
webhooks:manage	Configure webhook endpoints

1.Redirect user to authorization URL

GET /oauth/authorize?client_id=...&scope=...&redirect_uri=...

2.User grants permission, receives auth code

3.Exchange code for access token

POST /oauth/token { grant_type, code, client_id, client_secret }

4.Use access token in Authorization header

Authorization: Bearer eyJhbGc...

Tier	Requests	Burst	Notes
Standard	1,000/min	100	Default for all integrations
Partner	5,000/min	500	Approved partners
Internal	Unlimited	1,000	Pet360 services only

Rate Limit Headers: X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Reset

Don't