Authentication - ApartmentIQ API

The ApartmentIQ API uses Bearer token authentication. All requests include a token in the Authorization header:

Authorization: Bearer <access_token>

There are two ways to obtain a token: API Keys (recommended for production) and Access Tokens (for quick testing).

API Keys (recommended)
Access Tokens

Each API key provides a client ID and secret. Your app exchanges these for short-lived access tokens automatically — no manual token rotation needed.

Create an API Key

In the web app, open your user menu (bottom-left avatar) and choose My Settings.
In the API Credentials section, select the API Keys tab.
Click Create API Key and give it a name.
Copy both the Client ID and Client Secret. The secret is only shown once.

Store your client secret securely (e.g., environment variable or secrets manager). It cannot be retrieved after creation.

Exchange credentials for an access token

curl -s -X POST https://data.apartmentiq.io/oauth/token \
  -d "grant_type=client_credentials" \
  -d "client_id=<your_client_id>" \
  -d "client_secret=<your_client_secret>"

You can also send the request body as application/json instead of form-encoded parameters.

The response includes an access token and its expiration:

{
  "access_token": "sbJACKMpBpOWSZSlHohNmUCO8qergQExotQmCQB_aTo",
  "token_type": "Bearer",
  "expires_in": 7200,
  "scope": "api",
  "created_at": 1746655415
}

Make API requests

Use the access token in the Authorization header:

curl -s \
  -H "Authorization: Bearer <access_token>" \
  "https://data.apartmentiq.io/apartmentiq/api/v1/accounts"

When the token expires, request a new one using the same client credentials. Most OAuth libraries handle this automatically.

Access tokens expire after 2 hours (expires_in: 7200). The libraries below handle token refresh transparently, so you won’t need to re-fetch manually.

SDK quick start

const CLIENT_ID = process.env.AIQ_CLIENT_ID;
const CLIENT_SECRET = process.env.AIQ_CLIENT_SECRET;
const TOKEN_URL = "https://data.apartmentiq.io/oauth/token";
const BASE_URL = "https://data.apartmentiq.io/apartmentiq/api/v1";

let token = null;
let tokenExpiresAt = 0;

async function getToken() {
  if (token && Date.now() < tokenExpiresAt) return token;
  const res = await fetch(TOKEN_URL, {
    method: "POST",
    headers: { "Content-Type": "application/x-www-form-urlencoded" },
    body: new URLSearchParams({
      grant_type: "client_credentials",
      client_id: CLIENT_ID,
      client_secret: CLIENT_SECRET,
    }),
  });
  if (!res.ok) throw new Error(`Token request failed: ${res.status}`);
  const data = await res.json();
  token = data.access_token;
  tokenExpiresAt = Date.now() + (data.expires_in - 60) * 1000;
  return token;
}

// Make an API request
const res = await fetch(
  `${BASE_URL}/accounts`,
  { headers: { Authorization: `Bearer ${await getToken()}` } }
);
console.log(await res.json());

Access tokens are manually generated Bearer tokens. They’re useful for quick testing, scripts, and one-off requests.

Access tokens expire after 30 days. For production integrations, use an API Key instead.

Create an access token

In the web app, open your user menu (bottom-left avatar) and choose My Settings.
In the API Credentials section, select the Access Tokens tab.
Click Create Token, then copy the token shown. It is only displayed once.

Never share your token publicly or commit it to version control.

Make API requests

curl -s \
  -H "Authorization: Bearer <your_api_token>" \
  "https://data.apartmentiq.io/apartmentiq/api/v1/accounts"

Unauthorized responses

You’ll receive 401 Unauthorized if the token is missing, invalid, or expired.

{
  "error": "Unauthorized",
  "message": "Missing or invalid bearer token"
}

​Create an API Key

​Exchange credentials for an access token

​Make API requests

​SDK quick start

​Create an access token

​Make API requests

​Unauthorized responses

Create an API Key

Exchange credentials for an access token

Make API requests

SDK quick start

Create an access token

Make API requests

Unauthorized responses