# Integration API (/manage/integration-api/using-the-integration-api)

> Learn how to use Pangolin's REST API to automate and script operations with fine-grained permissions



The API is REST-based and supports many operations available through the web interface. Authentication uses Bearer tokens, and you can create multiple API keys with specific permissions for different use cases.

<Info>
  For Pangolin Community Edition, the integration API must be enabled. Check out [the documentation](/self-host/advanced/integration-api) for how to enable the integration API.
</Info>

## Authentication [#authentication]

All API requests require authentication using a Bearer token in the Authorization header:

<CodeBlockTabs defaultValue="cURL">
  <CodeBlockTabsList>
    <CodeBlockTabsTrigger value="cURL">
      cURL
    </CodeBlockTabsTrigger>

    <CodeBlockTabsTrigger value="JavaScript">
      JavaScript
    </CodeBlockTabsTrigger>

    <CodeBlockTabsTrigger value="Python">
      Python
    </CodeBlockTabsTrigger>
  </CodeBlockTabsList>

  <CodeBlockTab value="cURL">
    ```bash
    curl -H "Authorization: Bearer YOUR_API_KEY" \
      https://api.example.com/v1/
    ```
  </CodeBlockTab>

  <CodeBlockTab value="JavaScript">
    ```javascript
    const response = await fetch('https://api.example.com/v1/endpoint', {
      headers: {
        'Authorization': `Bearer ${apiKey}`
      }
    });
    ```
  </CodeBlockTab>

  <CodeBlockTab value="Python">
    ```python
    import requests

    headers = {'Authorization': f'Bearer {api_key}'}
    response = requests.get('https://api.example.com/v1/endpoint', headers=headers)
    ```
  </CodeBlockTab>
</CodeBlockTabs>

## API Key Types [#api-key-types]

Pangolin supports two types of API keys with different permission levels:

### Organization API Keys [#organization-api-keys]

Organization API keys are created by organization admins and have limited scope to perform actions only in that organization.

### Root API Keys [#root-api-keys]

Root API keys have some extra permissions and can execute operations across orgs. They are only available in the Community Edition Pangolin:

<Warning>
  Root API keys have elevated permissions and should be used carefully. Only create them when you need server-wide access.
</Warning>

## Creating API Keys [#creating-api-keys]

<Steps>
  <Step title="Access the admin panel">
    Navigate to your admin panel:

    * **Organization keys**: Organization → API Keys
    * **Root keys**: Server Admin → API Keys (self-hosted only)
  </Step>

  <Step title="Generate a new key">
    Click "Create API Key" and provide a descriptive name for the key.
  </Step>

  <Step title="Configure permissions">
    Select the specific permissions your API key needs from the permissions selector.

    <Frame caption="API key permissions selector showing available operations">
      <img src="/images/permissions.png" alt="API Key Permissions" />
    </Frame>
  </Step>

  <Step title="Copy and secure your key">
    Copy the generated API key immediately. It won't be shown again.

    <Warning>
      Store API keys securely and never commit them to version control. Use environment variables or secure secret management.
    </Warning>
  </Step>
</Steps>

## API Documentation [#api-documentation]

View the Swagger docs here: [https://api.pangolin.net/v1/docs](https://api.pangolin.net/v1/docs).

Interactive API documentation is available through Swagger UI:

<Frame caption="Swagger UI showing API endpoints and interactive testing">
  <img src="/images/swagger.png" alt="Swagger Docs" />
</Frame>

For self-hosted Pangolin, access the documentation at `https://api.your-domain.com/v1/docs`.