RESPONSES API
Authentication
Use Authorization: Bearer or X-API-Key on protected API endpoints.
Two accepted headers
Send your key as Authorization: Bearer, or as X-API-Key. Both are equivalent; pick one and stay consistent so your logs are readable.
- Authorization: Bearer $FOUR_ECHELON_API_KEY
- X-API-Key: $FOUR_ECHELON_API_KEY
Failure modes
A missing, malformed, or revoked key returns 401 authentication_error. A valid key without an active subscription returns 402 payment_required — that distinction matters, because one is a credential problem and the other is a billing one.
Partner webhooks are different
Inbound partner webhooks are authenticated by HMAC-SHA256 over the raw request body, not by API key. See partner CAD webhooks for the signature headers.