Getting an API Token
Request a token, send it in the Authorization header, and keep it secret.
Every API call must be authenticated. An anonymous request returns 401.
There are three ways to authenticate, and the right one depends on how you are calling.
| Method | What you send | Who uses it |
|---|---|---|
| Token | Authorization: Token | Scripts, servers, anything headless |
| Session | The sessionid cookie | The manager in your browser, automatically |
| OAuth2 | Authorization: Bearer | MCP clients, such as an AI assistant |
Getting a token
Tokens are issued by us rather than self-serve. Email hello@in.eninesites.com from the address on your account and say which site the token is for. You will get back a single string.
Using it
Request
curl -H "Authorization: Token $ENINE_TOKEN" \
https://e9sites.com/api/v1/site/
import os
import requests
headers = {"Authorization": f"Token {os.environ['ENINE_TOKEN']}"}
response = requests.get("https://e9sites.com/api/v1/site/", headers=headers)
response.raise_for_status()
print(response.json())
Keeping it safe
- Treat the token like a password. It carries your role on every site you belong to.
- Keep it in an environment variable, never in code you commit.
- Tokens do not expire on a schedule -- they stay valid until deactivated.
- If one leaks, email us and we will deactivate it immediately.