Authentication

The North API uses API keys for authentication. Each key is scoped to your team and can have specific permissions.

Getting your API key

Log into your North Dashboard
Navigate to Settings > Integrations
Click Create API Key
Give it a descriptive name (e.g., “Zapier Integration”)
Optionally add a description and expiration date
Copy your key immediately - you won’t see it again!

API keys have full access to your team’s data, making it simple to integrate with any service.

Keep your API key secure! Treat it like a password. Never commit it to version control or share it publicly.

Using your API key

Include your API key in the Authorization header of every request:

Authorization: Bearer north_sk_live_xxxxxxxxxxxx

Example request

curl -X GET \
  "https://api.northreports.com/v1/users/me" \
  -H "Authorization: Bearer north_sk_live_YOUR_KEY_HERE"

API Key format

North API keys follow this format:

north_sk_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxx

north_sk_ - Identifies it as a North secret key
live_ - Indicates production environment
xxx... - 32 character random string

Permissions

API keys have full access to all your team’s resources:

Resource	Capabilities
Reports	Create, read, update, delete, and publish reports
Comps	Manage comparable properties
Showings	Track showings and open houses
Social Media	Import engagement data
AI Insights	Generate summaries and insights
Team Info	View team details

Each API key is scoped to your team only. You cannot access data from other teams.

Common authentication errors

401 Unauthorized

{
  "error": {
    "message": "Invalid API key",
    "status": 401
  }
}

Causes:

Missing Authorization header
Incorrect key format
Key doesn’t exist or was revoked

403 Forbidden

{
  "error": {
    "message": "Permission denied: reports:create",
    "status": 403
  }
}

Cause: Your API key doesn’t have the required permission for this operation.

Key management best practices

Rotate keys regularly

Create new keys periodically and revoke old ones. This limits exposure if a key is compromised.

Use descriptive names

Name keys based on their purpose: “Zapier Automation”, “CRM Sync”, “Marketing Dashboard”

Set expiration dates

For temporary integrations, set an expiration date on the key.

Monitor usage

Check the “Last Used” timestamp in your dashboard to identify unused keys.

One key per integration

Create separate keys for each integration. This makes it easy to revoke access without affecting other systems.

Revoking a key

If you suspect a key has been compromised:

Go to Settings > Integrations
Find the compromised key
Click Revoke
The key is immediately invalidated

Any requests using that key will receive a 401 error.

Testing your key

Use the “Get Current User” endpoint to verify your key is working:

curl -X GET \
  "https://api.northreports.com/v1/users/me" \
  -H "Authorization: Bearer north_sk_live_YOUR_KEY"

const response = await fetch(
  'https://api.northreports.com/v1/users/me',
  {
    headers: {
      'Authorization': 'Bearer north_sk_live_YOUR_KEY'
    }
  }
);

const data = await response.json();
console.log(data);

import requests

response = requests.get(
    'https://api.northreports.com/v1/users/me',
    headers={
        'Authorization': 'Bearer north_sk_live_YOUR_KEY'
    }
)

print(response.json())

A successful response means your key is valid and you’re ready to start building!

​Authentication

​Getting your API key

​Using your API key

​Example request

​API Key format

​Permissions

​Common authentication errors

​401 Unauthorized

​403 Forbidden

​Key management best practices

​Revoking a key

​Testing your key

Authentication

Getting your API key

Using your API key

Example request

API Key format

Permissions

Common authentication errors

401 Unauthorized

403 Forbidden

Key management best practices

Revoking a key

Testing your key