User Authentication

🔐 Authentication: Using `x-api-key`

All Networked.co APIs are secured via a required authorization header called x-api-key.

📌 Overview

The x-api-key is a secure token that uniquely identifies a community owner on the platform. It must be included in the request headers for every API call made to backend services.

🔑 How `x-api-key` Works

Name	Type	Required	Description
x-api-key	String	✅ Yes	API key provided by the Networked Team . Used for authenticating requests.

📘 Important Details

Manually Issued by Networked Team
The x-api-key is manually generated and provided by Customer Executives at Networked.co. Communities cannot generate this key themselves.

Owner-Level Access Only
Requests made using the x-api-key are treated as being from the Community Owner (Admin). Ensure the Owner account has the necessary privileges — otherwise, you may encounter authorization errors.

Required for All API Calls
The x-api-key is mandatory for every API request. Any request sent without this key will result in an Unauthorized (401) error.

👉 Confidential and Secret Key
Treat your x-api-key as highly confidential. If you believe the key has been exposed, immediately contact a Networked Customer Executive. They can disable the compromised key and issue a new one.

👉 Loss of Secrecy = No Support
If the key is misused or leaked, Networked cannot provide support for any resulting unauthorized access or data breaches. Responsibility lies with the community to maintain key secrecy.

👤 Publishing as a member: the `userid` header

Every request runs as the community owner (see above). On the create endpoints only, you may add an optional userid header to publish as one of your members; that member is then shown as the author.

Name	Type	Required	Description
userid	String	No	Id of an accepted member of your community. Omit it to publish as the owner. Member ids come from Directory → Users List.

Where it applies

Endpoint	What `userid` sets
`POST /api/v1/posts/external`	Author of the post
`POST /api/v1/posts/comment`	Author of the comment
`POST /api/v1/posts/upload/media`	Owner of the uploaded file
`POST /events`	Organiser of the event
`POST /api/v1/polls`, `POST /api/v1/surveys`	Author of the poll or survey

Rules

The id must belong to an accepted member of the same community as the key. Any other id is refused with 401 Unauthorized.

On every other endpoint (lists, profile, directory, members, newsletter, plans) the header is ignored and the request runs as the owner.

Content published through the API, with or without userid, is published by the owner's key and therefore does not go through content approval, exactly as an owner's own post in the app.

The spaceId header, where an endpoint lists it, targets a Space directly under your community; it can be combined with userid.

🚦 Rate Limiting

To ensure fair usage and optimal performance, external API requests are subject to rate limits.

⏱️ Request Limits

Time Window	Maximum Requests
1 Minute	10 requests
10 Minutes	50 requests
60 Minutes	120 requests

If the rate limit is exceeded, the API will respond with the following error:

❌ Rate Limit Error Response

Status Code: 429 Too Many Requests

Response Body:

{
  "error": true,
  "message": "Too Many Requests"
}

🔁 Recommendations

Implement retry logic .

Avoid making unnecessary repeated calls within a short span.

🔐 Authentication: Using x-api-key#

📌 Overview#

🔑 How x-api-key Works#

📘 Important Details#

👤 Publishing as a member: the userid header#

Where it applies#

Rules#

🚦 Rate Limiting#

⏱️ Request Limits#

❌ Rate Limit Error Response#

🔁 Recommendations#