Skip to main content
The Gapstack API accepts two credentials. Send one of them on every authenticated request. Most product endpoints accept either header. A few account-level endpoints, such as listing your tenants, expect the JWT. Webhooks and GET /healthcheck are unauthenticated.
The OpenAPI security scheme is BearerAuth for JWTs and ApiKeyAuth for the x-api-key header. In the playground, set the token or key once and Mintlify sends it with each request.

​
JWT bearer token

Use a Cognito access token in the Authorization header.
The token identifies the current user. Gapstack then scopes data to the tenants that user belongs to.

​
API key

API keys are per tenant. Create one after you have a tenant ID:
Send the key on later requests. Tenant-scoped routes still need Tenant-Id.
Rotate or revoke a key with PUT or DELETE on /tenant/{tenantId}/api-key/{apiKeyId}.

​
Tenant-Id header

Any route that does not include {tenantId} in the path, and is not a global settings or webhook route, expects this header:
If you omit it, the API cannot resolve the tenant and the request fails.
Tenant CRUD, tenant members, tenant API keys, invitations, settings, subscription, GitHub callbacks, and GET /healthcheck do not use the header. They either take tenantId in the path or run outside a tenant.

​
Webhook signatures

Inbound webhooks verify a signature header instead of a user token:
  • GitHub App: X-Hub-Signature-256 and X-GitHub-Event on POST /github/webhook
  • Subscription billing: x-webhook-signature on POST /subscription/webhook