8Tracks Authentication

generated: '2026-07-17'
method: searched
source: >-
  8tracks API v3 documentation (https://8tracks.com/developers/api_v3), the
  "includes" reference (https://8tracks.com/developers/includes), and behavior
  confirmed across community client libraries (dbrgn/orochi, motemen/WebService-8tracks,
  metacpan WebService::8tracks).
api: 8tracks API v3
summary: >-
  Application access is by API key, supplied either as an api_key query parameter
  or an X-Api-Key HTTP header. Every request must also declare the API version via
  an api_version query parameter or an X-Api-Version header. User-scoped actions
  (likes, favorites) additionally require a user session token obtained by posting
  credentials to sessions.json and then sending an X-User-Token header. New API
  keys have not been issued since February 2015.
schemes:
- id: api_key
  type: apiKey
  in: header
  name: X-Api-Key
  alt_in: query
  alt_name: api_key
  required: true
  description: >-
    Per-application key that authenticates the calling client. Accepted as the
    X-Api-Key header or the api_key query parameter. No new keys issued since
    2015-02.
- id: api_version
  type: apiKey
  in: header
  name: X-Api-Version
  alt_in: query
  alt_name: api_version
  required: true
  description: >-
    Declares the API version (3 for the latest documented surface). Must be sent
    on every call, as the X-Api-Version header or the api_version query parameter.
- id: user_token
  type: apiKey
  in: header
  name: X-User-Token
  required: false
  description: >-
    Session token identifying an authenticated end user, required only for
    user-scoped write actions (like/unlike a mix, fav/unfav a track). Obtained by
    POST sessions.json with the user's login and password (HTTP Basic), and
    invalidated by POST logout.
oauth2: false
openid_connect: false
mutual_tls: false
notes: >-
  The API predates OAuth 2.0 adoption at 8tracks; there is no documented OAuth or
  OpenID Connect flow. User authentication is a proprietary username/password
  session exchange returning a user token.