Authentication

The Slim.io API uses Firebase JWT tokens for authentication. Every API request must include a valid token in the Authorization header.

Obtaining a Token

Your API credentials are provisioned when your tenant is created. Contact your account administrator for API keys or service account details.

From the Firebase Auth SDK

If you are building a client application, use the Firebase Authentication SDK to obtain a JWT token:

import { getAuth } from 'firebase/auth'
 
const auth = getAuth()
const user = auth.currentUser
const token = await user.getIdToken()

From a Service Account

For server-to-server integrations, use a Firebase service account to generate custom tokens:

import firebase_admin
from firebase_admin import auth
 
firebase_admin.initialize_app()
custom_token = auth.create_custom_token(uid='service-account-uid')

Then exchange the custom token for an ID token via the Firebase Auth REST API.

From an API Key

For simpler integrations, generate an API key from the Customer Dashboard under Settings > API Keys:

curl -X GET https://api.slim.io/api/v1/connectors \
  -H "Authorization: Bearer sk_live_abc123def456"

Authorization Header

Include the token in every API request:

curl -X GET https://api.slim.io/api/v1/connectors \
  -H "Authorization: Bearer eyJhbGciOiJSUzI1NiIs..."

The Bearer prefix is required. Requests without a valid authorization header receive a 401 Unauthorized response.

Token Refresh

Firebase ID tokens expire after 1 hour. The recommended refresh strategy:

1. Attach a token listener that fires before expiry:

import { getAuth, onIdTokenChanged } from 'firebase/auth'
 
const auth = getAuth()
onIdTokenChanged(auth, async (user) => {
  if (user) {
    const token = await user.getIdToken()
    // Update your API client's authorization header
  }
})

2. On 401 response, force a token refresh and retry:

async function apiCall(url, options = {}) {
  let response = await fetch(url, {
    ...options,
    headers: { ...options.headers, Authorization: `Bearer ${token}` }
  })
 
  if (response.status === 401) {
    token = await auth.currentUser.getIdToken(true) // force refresh
    response = await fetch(url, {
      ...options,
      headers: { ...options.headers, Authorization: `Bearer ${token}` }
    })
  }
 
  return response
}

Token Payload

The Firebase JWT token payload includes:

Slim.io extracts the sub claim to identify the user and resolve their workspace membership and role.

Token Validation

The API validates tokens on every request through the following process:

1. Extract the Authorization header
2. Verify the JWT signature against the identity provider’s public keys
3. Check token expiry (exp claim)
4. Resolve the user’s tenant and workspace from the sub claim
5. Attach user context to the request for authorization checks

Invalid tokens, expired tokens, or missing headers result in a 401 response with error details.

Security Best Practices

1. Never expose tokens in URLs — Always use the Authorization header, never query parameters
2. Store tokens securely — Use secure, HTTP-only cookies or in-memory storage, not localStorage
3. Rotate API keys — Rotate API keys at least quarterly and immediately if compromised
4. Use least-privilege keys — Create API keys with the minimum required role (prefer Viewer for read-only integrations)
5. Monitor token usage — Review API key usage logs in the dashboard for anomalous patterns