Authentication
Create an API token and send it in the Authorization header of every request.
Every API request is authenticated with an API token in the Authorization header, prefixed with the word Token and a space:
Authorization: Token YOUR_API_TOKENThe prefix is Token, not Bearer. A Bearer header is not accepted by the parsing endpoints.
Create a token
- Open Settings → API Tokens in the app. You can also click Generate Token on any parser's Integrations tab.
- Click Generate Token.
- Name it after where it will be used, for example
invoice-sync-productionorci. - Choose an expiry: 7 days to 1 year, or No Expiration.
- Copy the token and store it in your secrets manager or environment.
Tokens act for the account that created them, and documents they process are charged to that account's balance.
Use it from your code
Read the token from the environment rather than hard-coding it:
export SIMPLYPARSE_API_TOKEN="your-token"
curl "https://api.simplyparse.com/dapi/v1/parser/$PARSER_SLUG/parse" \
-H "Authorization: Token $SIMPLYPARSE_API_TOKEN" \
-F "file=@invoice.pdf"Check that a token works
Request a document ID that does not exist. A working token gets a normal JSON reply with document_not_found; a bad token gets HTTP 401:
curl "https://api.simplyparse.com/dapi/v1/parser/$PARSER_SLUG/document/00000000-0000-0000-0000-000000000000" \
-H "Authorization: Token $SIMPLYPARSE_API_TOKEN"{ "status": "error", "code": "document_not_found", "message": "Please provide a valid document ID", "data": null }Authentication errors
Authentication failures return HTTP 401 with a detail message instead of the usual status/code envelope:
detail | Cause | Fix |
|---|---|---|
Authentication credentials were not provided. | No Authorization header, or it doesn't start with Token. | Send Authorization: Token <token>. |
Invalid token. | The token doesn't exist. | Check for copy/paste errors or a stray newline. |
Invalid token header. No credentials provided. | The header is just Token. | Add the token after a single space. |
Invalid token header. Token string should not contain spaces. | Extra words or spaces after the token. | Send exactly Token <token>. |
Access token inactive or deleted. | The token was deactivated. | Create a new token. |
Access token has expired. | The token's expiry date has passed. | Create a new token and rotate it in. |
User inactive or deleted. | The account that owns the token is deactivated. | Contact your workspace admin. |
Keep tokens safe
- Server-side only. Never ship a token in a website, mobile app or anything a user can download. Call SimplyParse from your backend.
- One token per integration and environment. You can revoke or rotate one without breaking the others.
- Prefer an expiry for tokens used by people or short-lived systems, and rotate long-lived tokens on a schedule.
- Revoke immediately if a token is exposed, for example committed to a repository or pasted into a ticket. Deactivate or delete it in Settings → API Tokens; it stops working at once.