Finalcad Authentication

generated: '2026-08-17'
method: searched
source: https://developer.finalcad.com/
docs: https://developer.finalcad.com/
notes: >-
  Derived mechanically from the OpenAPI documents in openapi/ (themselves derived from Finalcad's
  first-party Postman collection), then upgraded from the "Getting started" section Finalcad
  publishes on its developer portal at https://developer.finalcad.com/ and the help-centre article
  "Get your API key" (https://help.finalcad.com/en/articles/86-get-your-api-key).
access_gate:
  entitlement: Enterprise licence
  statement: >-
    "To access the Finalcad One API, the client organization must be subscribed to the 'Enterprise'
    offer. This offer makes it possible to obtain a API Key which will allow access to the API."
    Finalcad validates an organization's eligibility before issuing the key.
  self_service: partial
  self_service_note: >-
    The key itself is generated by the customer from the user menu of the Finalcad One web app once
    the organization is eligible; eligibility is not self-service.
  source: https://developer.finalcad.com/
summary:
  types:
  - apiKey
  api_key_in:
  - header
  oauth2_flows: []
  two_factor_headers: true
  two_factor_note: >-
    Every call carries TWO headers. X-API-Key identifies the calling ORGANIZATION; Authorization
    carries the CALLER's rights. Sending only one is a 401 (observed live:
    GET https://developer.finalcad.cloud/api/organizations returns
    401 UnauthorizedException from AWS API Gateway with no credentials).
schemes:
- name: apiKey
  type: apiKey
  in: header
  parameter: X-API-Key
  description: >-
    Organization API key issued by Finalcad once the organization's eligibility for API access has
    been validated. It identifies the calling organization on every API call. Finalcad's docs state
    the key must remain confidential and that sharing it without the organization's consent may
    result in unauthorized third-party usage; keys can be revoked from the same web menu that
    issues them.
  sources:
  - openapi/finalcad-authentication-openapi.yml
  - openapi/finalcad-libraries-openapi.yml
  - openapi/finalcad-medias-openapi.yml
  - openapi/finalcad-organizations-openapi.yml
  - openapi/finalcad-projects-openapi.yml
  - openapi/finalcad-webhooks-openapi.yml
- name: tokenAuth
  type: apiKey
  in: header
  parameter: Authorization
  description: >-
    Bearer-style credential carrying the caller's permissions. Two published forms:
    `Authorization: token <your_api_key>` (current) and `Authorization: bearer <your_user_token>`
    (legacy user-token flow). Finalcad also states that for authorization management the user
    (physical or service account) must be authenticated on the Finalcad platform to obtain an
    OAuth 2.0 token that carries their rights — but Finalcad publishes no authorization server
    metadata, no token/authorize endpoint and no scope reference, so the OAuth 2.0 flow is not
    documented as a public, self-serve integration surface.
  sources:
  - openapi/finalcad-authentication-openapi.yml
  - openapi/finalcad-libraries-openapi.yml
  - openapi/finalcad-medias-openapi.yml
  - openapi/finalcad-organizations-openapi.yml
  - openapi/finalcad-projects-openapi.yml
  - openapi/finalcad-webhooks-openapi.yml
legacy_token_endpoint:
  operationId: getUserToken
  method: POST
  path: /auth
  server: https://developer.finalcad.cloud/api
  request: '{"login": "<string>", "password": "<string>"}'
  response_fields:
  - user_token
  - expiration_date
  note: >-
    Labelled "Legacy endpoint to get user_token" in Finalcad's own collection. The example response
    is a JWT issued by an Okta authorization server; token lifetime in the published example is
    24 hours (iat/exp one day apart). Password-grant style credentials in the request body — prefer
    the API key form for new integrations.
scopes:
  published: false
  note: >-
    No OAuth 2.0 scope or permission reference is published. Effective permissions come from the
    Finalcad One role model (organization roles via GET /organizations/{organization_id}/organization-roles
    and project roles via GET /projects/{project_id}/roles), which is enforced against the user
    behind the Authorization header rather than declared as scopes.
probes:
- url: https://developer.finalcad.cloud/api/organizations
  status: 401
  detail: 'x-amzn-errortype: UnauthorizedException — AWS API Gateway'
- url: https://developer.finalcad.cloud/api
  status: 403
  detail: '{"message":"Missing Authentication Token"}'
- url: https://developer.finalcad.cloud/.well-known/oauth-authorization-server
  status: 403
  detail: no authorization-server metadata served