API key authentication

  • Published on May 20, 2026
Prev Next

API key authentication flow is the method used to authenticate to APIs that provide an API key or an access token, which must be included in each request.

The API key authentication type is configured with type: "user_input" in the JSON configuration.

In this authentication type, you must define one or multiple input fields to be shown when connecting to the data source.

api-key

Configuring API key authentication

API key authentication is configured with type user_input in the connector configuration. User input authentication allows you to request the user to input necessary credentials during the authentication flow, which you can later use in API requests through placeholders.

Below, you can find an example where we are defining three input fields for the authentication flow:

  • Account name (ID: account_name)
  • API key (ID: api_key)
  • Company name (ID: company_input)

Account name and Company name are defined as text fields, and the API key is defined as a password. As the API key is a password, the typed value is hidden. The configuration for the authentication would look like this:

{
  ...
  "authentication": {
    "type": "user_input",
    "description": "This is a description for API key authentication"
    "userInputs": [
      {
        "id": "account_name",
        "label": "Account name",
        "type": "text"
      },
      {
        "id": "api_key",
        "label": "API key",
        "type": "password"
      },
      {
        "id": "company_input",
        "label": "Company name",
        "type": "text"
      }
    ]
  }
  ...
}

In this case, the Supermetrics data source connection flow would look like this:

image-20220421-122257

Storing inputted values in Data source user

To have values inputted by the user stored securely, and to use these values later in the configuration, we need to define these values to be stored using the Data source user component.

Below you can find an example Data source user configuration for the above authentication. In this example configuration:

  • The API key inputted by the user is stored as accessToken and it's used to identify users when making requests to APIs, and it's not publicly exposed.
  • The Account name inputted by the user is stored as label so users can identify different authentications from each other.
  • A Data Source User ID is generated using the {{identity()}} placeholder to generate a unique ID for each authentication.
  • The company name is stored under additional properties with the ID company

An example of full authentication and data source user configuration for the above would look like this:

"authentication": {
  "type": "user_input",
  "description": "This is a configured login description",
  "userInputs": [
    {
      "id": "account_name",
      "label": "Account name",
      "type": "text"
    },
    {
      "id": "api_key",
      "label": "API key",
      "type": "password"
    },
    {
      "id": "company_input",
      "label": "Company name",
      "type": "text"
    }
  ]
},
"dataSourceUser": {
  "userInfo": {
    "id": {
      "source": "static",
      "value": "{{ identity() }}"
    },
    "label": {
      "source": "userInput",
      "value": "account_name"
    },
    "accessToken": {
      "source": "userInput",
      "value": "api_key"
    },
    "properties": [
      {
        "id": "company",
        "source": "userInput",
        "value": "company_input"
      }
    ]
  }
}

Using user-inputted values in requests

To use the values the user has inputted during the authentication, and which we stored under data source user, we should use placeholders. These placeholders can be used under request object in any part of the configuration. Within request object, you can define the placeholder to be used in:

  • Request URLs
  • Request headers or parameters

With the above configuration, you would have the following placeholders available to use:

  • {{user.access_token}} to use the API key inputted by the user
  • {{user.id}} to use the generated unique ID value
  • {{user.label}} to use the Account name inputted by the user
  • {{user.properties.company}} to use the Company name inputted by the user

An example usage of company name in the request URL under and API key in the request headers could look like this:

"request": {
  "method": "GET",
  "url": "https://{{user.properties.company}}.exampleAPI.com/products",
  "headers": [
    {
      "name": "api_key",
      "value": "{{user.access_token}}"
    }
  ],
  "response": {
    "type": "JSON",
    "dataRows": {
      "source": "jsonPath",
      "value": "$.products.*"
    }
  }
}

© Supermetrics 2025