Skip to content
Merulan

Authentication

Exchange an API key for a short-lived access token, then send the token and Workspace scope with an API request.

Authentication turns an API key into the short-lived bearer token for the HTTP API. Use it before an admitted method request. Keep the credential out of source control and logs.

Exchange a key

For API authentication, create an API key in Settings → Developers. Exchange it at the application token endpoint. Send the key only as a bearer credential to that endpoint. The response has an access_token and identifies it as Bearer. It expires after 300 seconds. Store the token only while making API calls. The exchange reads MERULAN_API_KEY. Set it to the key you created before you run the command.

curl -s -X POST https://app.merulan.com/api/oauth/campaign/token \
  -H "Authorization: Bearer $MERULAN_API_KEY"

Send an API request

API authentication sends the returned token as Authorization: Bearer $MERULAN_ACCESS_TOKEN. Do not send a credential in a query value. Send x-merulan-workspace-id for a Workspace the caller can access. The API checks one Workspace for each admitted request. The generated API reference names the method's permission and Workspace target. Check both before you send the request.

Recover access

Recover API authentication by exchanging the key when a token expires. Retry only after checking the method's terminal. If exchange rejects the key, create a new key in Settings → Developers. Remove the revoked key from the integration. If the API rejects a Workspace, choose one the caller can access. A credential does not widen access.

API authentication leads to the setup and method pages below.

  • The API guide explains request, pagination, terminal, and readback conventions after access is established.
  • The generated API reference gives the exact credential, scope, permission, and response contract for an admitted method.