Copy page

Getting Started

Authentication

GoSmarter API supports two authentication methods.

Method	Header	Best for
API key	GoSmarter-Api-Key: zpka_...	Scripts, CI/CD, server-to-server, automation
Bearer token	Authorization: Bearer eyJ...	Interactive apps, user-delegated access

---

API keys

Code
GET /api/company/{companyId}/millcert/certificates
GoSmarter-Api-Key: zpka_your_key_here

See the API Keys guide for creating, rotating, and revoking keys.

---

Bearer tokens (Clerk)

GoSmarter uses Clerk for user authentication. Bearer tokens are Clerk session JWTs issued after sign-in.

Getting a token (machine-to-machine)

For server-side integrations, use Clerk's machine authentication. Contact your GoSmarter administrator for credentials.

Getting a token (interactive / developer portal)

Sign in to this portal using the Sign in button. Once authenticated, the portal injects your session token automatically into API explorer requests.

Using the token

Code
curl "https://api.gosmarter.ai/api/company/YOUR_COMPANY_ID/millcert/certificates" \
  -H "Authorization: Bearer YOUR_SESSION_TOKEN"

Code examples

JavaScript / Node.js

Code
// With @clerk/backend SDK (server-side)
import { createClerkClient } from '@clerk/backend';

const clerk = createClerkClient({ secretKey: process.env.CLERK_SECRET_KEY });

// Verify an existing session token from your frontend
async function getVerifiedToken(sessionToken) {
  const session = await clerk.sessions.verifyToken(sessionToken);
  return session; // contains user claims
}

async function callAPI(companyId, sessionToken) {
  const response = await fetch(
    `https://api.gosmarter.ai/api/company/${companyId}/millcert/certificates`,
    { headers: { Authorization: `Bearer ${sessionToken}` } }
  );
  return response.json();
}

Python

Code
import requests

def call_api(company_id: str, session_token: str):
    resp = requests.get(
        f"https://api.gosmarter.ai/api/company/{company_id}/millcert/certificates",
        headers={"Authorization": f"Bearer {session_token}"},
    )
    resp.raise_for_status()
    return resp.json()

---

Troubleshooting

401 Unauthorized

• API key: verify the key is valid — visit Settings → API Keys in this portal
• Bearer token: the token may have expired; Clerk session tokens are short-lived, fetch a fresh one
• Check the header name is exact: GoSmarter-Api-Key or Authorization: Bearer <token>

401 Unauthorized — "API key metadata is missing userId"

• Delete and recreate the key from Settings → API Keys.

403 Forbidden

• Your account may not have access to the requested company. Contact your administrator.