Storyclash Authentication

generated: '2026-08-13'
method: searched
source: https://storyclash.notion.site/Storyclash-API-Documentation-1266dc2ddd0880a79cf9e3d34c19fa01
docs: https://storyclash.notion.site/Storyclash-API-Documentation-1266dc2ddd0880a79cf9e3d34c19fa01
also: https://www.storyclash.com/integrations/api-integration
correction: >-
  Supersedes the 2026-07-21 profile, which recorded the token as an apiKey in a request
  HEADER. The provider's own API documentation shows it is a QUERY PARAMETER on the two GET
  endpoints (?token={YOUR_AUTH_TOKEN}) and a JSON BODY FIELD on the POST creator-import
  endpoint. Verified against a live unauthenticated call to
  https://app.storyclash.com/external-api/campaigns, which returns HTTP 200 with
  {"message":"Invalid API Key"} — an error body, not a 401 challenge, and no
  WWW-Authenticate header.
summary:
  types: [apiKey]
  api_key_in: [query, body]
  oauth2_flows: []
  notes: >-
    Storyclash publishes no machine-readable OpenAPI. A single opaque per-customer token is
    the whole authentication model. There is no OAuth2, no OpenID Connect, no scope surface
    and no refresh/rotation mechanism documented, so scopes/ is not applicable. The token is
    provisioned by Storyclash (enterprise arrangement, "Get API access" / "Request Enterprise
    Demo"), not self-issued from a dashboard.
schemes:
  - name: apiToken
    type: apiKey
    in: query
    parameter: token
    description: >-
      Opaque per-customer token issued by Storyclash. Appended to the request URL on the
      Campaign Data and All Campaigns endpoints, e.g.
      GET https://app.storyclash.com/external-api/campaigns?token={YOUR_AUTH_TOKEN}
    applies_to:
      - GET /external-api/campaign/{campaign_id}
      - GET /external-api/campaigns
    sources: [https://storyclash.notion.site/Storyclash-API-Documentation-1266dc2ddd0880a79cf9e3d34c19fa01]
  - name: apiTokenBody
    type: apiKey
    in: body
    parameter: token
    description: >-
      The same token supplied as the "token" field of the JSON request body on the creator
      import endpoint.
    applies_to:
      - POST /external-api/import/creator
    sources: [https://storyclash.notion.site/Storyclash-API-Documentation-1266dc2ddd0880a79cf9e3d34c19fa01]
failure_modes:
  - condition: token missing or invalid
    observed_status: 200
    body: '{"message":"Invalid API Key"}'
    note: >-
      Probed 2026-08-13 on https://app.storyclash.com/external-api/campaigns. The API returns
      200 with a JSON error envelope rather than 401/403, so a client cannot rely on the HTTP
      status to detect an auth failure and must inspect the body.
  - condition: token valid but the feature is not enabled for that customer
    documented_message: Invalid API Key
    note: >-
      The creator-import error table lists "The supplied token is not valid or the feature is
      not active for that token" as producing the same "Invalid API Key" response, so
      authorization failures are indistinguishable from authentication failures.
transport:
  https: true
  hsts: true
  note: app.storyclash.com sends strict-transport-security max-age=31536000; includeSubDomains; preload.
security_observations:
  - >-
      The token travels in the query string on GET requests, so it is exposed to proxy logs,
      browser history and Referer headers. There is no header-based alternative documented.
  - No token rotation, expiry or revocation procedure is published.