Authentication & API Keys

API v2.4 Last updated: Oct 15, 2026 ⏱ 8 min read

Aevum Zenth's API uses OAuth 2.0 and API keys for authentication. All requests must be made over HTTPS and include valid credentials in the Authorization header.

ℹ️

Production Keys Live API keys begin with az_prod_. Sandbox keys begin with az_test_. Never commit production keys to version control.

Using API Keys

API keys are the simplest way to authenticate. Generate them from the Developer Dashboard and attach them to your requests:

                        HTTP / cURL
                        
                    
curl https://api.aevumzenth.com/v2/resources \
  -H "Authorization: Bearer az_prod_your_api_key_here" \
  -H "Content-Type: application/json"

OAuth 2.0 Flow

For user-delegated access, implement the standard Authorization Code flow with PKCE. Aevum Zenth supports the following grant types:

Authorization Code - Standard web/mobile applications
Client Credentials - Server-to-server machine accounts
Refresh Token Rotation - Automatic token renewal with sliding windows

⚠️

Token Expiry Access tokens expire after 15 minutes. Refresh tokens are valid for 30 days and rotate on each use. Implement automatic retry logic for 401 responses.

Token Request

Exchange your authorization code for an access token by posting to the token endpoint:

                        Python
                        
                    
import requests

url = "https://auth.aevumzenth.com/oauth/token"
payload = {
    "grant_type": "authorization_code",
    "code": "AUTH_CODE_FROM_CALLBACK",
    "client_id": "your_client_id",
    "code_verifier": "your_code_verifier"
}

response = requests.post(url, json=payload)
tokens = response.json()

Rate Limits & Quotas

API access is tiered based on your subscription plan. Exceeding limits will result in 429 Too Many Requests responses with a Retry-After header.

Plan	Requests / Minute	Requests / Day	Burst Allowance
Developer	60	10,000	15
Team	300	500,000	50
Enterprise	Unlimited	Unlimited	Custom

🚫

Security Notice Repeated 429 responses (>100 in 5 minutes) will trigger temporary IP throttling. Contact Enterprise Support to whitelist CIDR ranges for production workloads.

Standard Error Responses

All errors follow RFC 7807 Problem Details. The response body includes a type URI pointing to the relevant documentation.

                        JSON
                        
                    
{
  "type": "https://docs.aevumzenth.com/errors/invalid_grant",
  "title": "Invalid Authorization Grant",
  "status": 401,
  "detail": "The provided refresh token has expired or been revoked.",
  "instance": "/oauth/token",
  "trace_id": "req_8f3a2c1d90e4"
}