The v3 data endpoint is authenticated with a bearer token that is scoped to
a single account.
Getting your credentials
API token
To create an API token:
- Log in to your Redo Dashboard
- Go to Settings → Developer
- Click Add API Client
- Copy the generated API secret
Store your API secret securely. It will only be shown once when created.
Account ID
Your account ID is part of the data endpoint path. It is shown in the
General section of Settings → Developer in the Redo Dashboard, and
looks like acc_....
Making authenticated requests
Send every operation as a POST to the data endpoint for your account, with the
token in the Authorization header:
The token is validated against the account ID in the path. A malformed header,
unknown token, or a token that does not belong to that account all fail the same
way — with an Unauthorized error — so they cannot be told apart:
Never share your API secret publicly or commit it to version control.
Scopes
Tokens carry scopes that determine which fields they may read or write.
Fields you are not scoped for are denied even when the token is otherwise valid,
and because a nested field’s scope is additive to its parent’s, a request needs
the union of every scope along its selection path. Grant a client only the
scopes it needs in the Dashboard.
See Access scopes for the full list,
and the Required scopes on each query, mutation, and field in the reference.
Introspection without a token
The schema endpoint
(https://api.getredo.com/v3/graphql-schema) is unauthenticated and exposes the
schema only — never account data. Use it to explore types and generate clients
without a token. 
