Authentication and authorization - Sprig Docs

All Study API requests use HTTPS and send credentials in the Authorization header. Never expose credentials in browser code, mobile applications, logs, source control, or support messages.

Environment API key

Use an environment API key for server-to-server integrations:

Authorization: API-Key YOUR_API_KEY

Each key belongs to one Production or Development environment. The key selects the environment for the request, so an environment header is not needed.

curl https://api.sprig.com/v2/studies \
  --header "Authorization: API-Key $SPRIG_API_KEY"

Use a Development key to test an integration without changing Production Studies. Team members with the Admin or Developer role can find environment API keys in Integrations > Enrichment > Data Import API.

Authentication failures

Status	Meaning	Action
`403`	The API key is missing or invalid, cannot access the resource, or the Study API is unavailable for the account.	Check the key, selected environment, and account access.

Do not retry 403 in a tight loop. Resolve the credential or account-access problem first.

Credential handling

Store API keys in a secret manager.
Use separate credentials for Production and Development.
Rotate a credential immediately if it may have been exposed.
Redact Authorization values from logs and traces.

⌘I