Staffbase · Authentication Profile

Staffbase Authentication

Authentication

Staffbase secures its APIs with http across 1 declared security scheme, as derived from its OpenAPI definitions.

CompanyEmployee CommunicationsInternal CommunicationsEmployee ExperienceIntranetEmployee AppEmailHR TechEnterprise
Methods: http Schemes: 1 OAuth flows: API key in:

Security Schemes

apiToken http
scheme: basic

Source

Authentication Profile

staffbase-authentication.yml Raw ↑ 
generated: '2026-07-21'
method: searched
source: https://developers.staffbase.com/api/
docs: https://developers.staffbase.com/api/
notes: >-
  Derived from the Staffbase developer portal and a live 401 challenge against the
  API base. No downloadable OpenAPI/Swagger definition is published, so this profile
  is documented from the developer portal rather than mechanically derived from a spec.
base_url: https://app.staffbase.com/api
summary:
  types: [http]
  http_schemes: [basic]
  api_key_in: []
  oauth2_flows: []
schemes:
  - name: apiToken
    type: http
    scheme: basic
    description: >-
      API access uses HTTP Basic authentication carrying a Staffbase API token.
      Tokens are generated per-installation in the Staffbase Studio admin and scope
      access to a branch/space. Unauthenticated calls return HTTP 401 with a JSON
      error envelope (ref ERROR_LOGIN_REQUIRED).
    evidence:
      - "GET https://app.staffbase.com/api/users -> 401 application/json {ref: ERROR_LOGIN_REQUIRED}"