Api Documentation
Security

Security

The Reuzenpanda API authenticates every request with a Bearer token in the Authorization header:

Authorization: Bearer <token>

The full endpoint reference — every route, its parameters and response schemas — is documented in the OpenAPI specification at api.reuzenpanda.app (opens in a new tab).

Request an API token

For your own scripts and integrations you can create a token yourself — no need to contact us:

  1. Open Reuzenpanda Hub (hub.reuzenpanda.nl) or giantpanda.ai.
  2. Go to Settings → API tokens.
  3. Create a token for the company profile you want to grant access to, and copy it.

A token is pinned to a single company profile, so you don't need to pass the profile separately. Send it as a Bearer token on every request:

GET /...
Authorization: Bearer <your-api-token>

Keep the token secret. You can revoke it at any time from the same API tokens settings, and revocation takes effect immediately.

OAuth2

The Reuzenpanda API is OAuth2 compliant. Applications can authenticate on a user's behalf using the standard OAuth2 authorization-code flow against our identity provider at https://idp.reuzenpanda.nl. The authorization, token, introspection and JWKS endpoints are listed in the OpenID configuration (opens in a new tab).

To register an OAuth2 client, contact support@reuzenpanda.nl.

Legacy: service-account sign-in (deprecated)

Deprecated. This flow is kept only for existing integrations. New integrations should connect through Zapier or use an API token from your settings (see above). Support for OpenID/OAuth2 has now shipped and replaces this scheme.

Reuzenpanda API v1 originally used a custom authentication scheme based on service accounts. Each service account has a unique API key and secret. The API key is used as the username and the secret as the password.

Obtaining a service account

To obtain a service account, please contact the Reuzenpanda team.

Obtain bearer token

To authenticate, send a POST request to the /login-api endpoint with the service account credentials in the body. You will receive a JWT Bearer token in response.sessionKey, valid for 2 hours.

POST /login-api

Request body:

{
  "email": "service-account-name",
  "password": "service-account-secret"
}

Response body:

{
    "type": "SUCCESS",
    "user": {
        "id": "service-account-id",
        "email": "service-account-name",
        "name": null,
        "password": "",
        "locale": null,
        "role": "API"
    },
    "sessionKey": "BEARER",
    "attemptsLeft": 0,
    "should_check_two_factor": false
}

Authenticating with the API

Add an X-AUTHORIZATION header with the sessionKey as value to your requests.

Connecting a service account to a new profile

A user can "invite" a service account to their profile, allowing the service account to access the user's data. Open your dashboard, go to the "Profile roles" section in settings, and enter the service account's name. The invite is accepted immediately, and the service account can access the user's data.

OverviewWebsite Installation