Authentication

The InChurch API uses basicAuthentication with API Key and Secret to secure all requests. This guide explains how to create API clients, manage credentials, and authenticate your requests.

API Client Management

Creating an API Client

API Client Scopes

Every API client must have a unique scope level:

Permission System

Permissions follow the format <resource>:<method> where methods include:

• GET - Retrieve or view data
• POST - Create new data
• PATCH - Update existing data
• DELETE - Remove data

Examples:

• people:GET - Retrieve member information
• donations:POST - Create new donations
• donations:PATCH - Update existing donations
• events:DELETE - Delete events

API Credentials

API Key & Secret

When you create an API client, you'll receive:

• API Key: Public identifier (immutable, safe to log)
• API Secret: Private key (shown only once, never stored in plaintext)

Credential Storage

Store your credentials securely:

Code
 
# Environment variables (recommended)
INCHURCH_API_KEY=your_api_key_here
INCHURCH_API_SECRET=your_api_secret_here

Making Authenticated Requests

Required Headers

Include these headers in all API requests:

Code
 
Authorization: Basic {BASE64_ENCODED_CREDENTIALS}
Content-Type: application/json
X-API-Version: v1

Where {BASE64_ENCODED_CREDENTIALS} is the Base64 encoding of your API Key and API Secret joined with a colon (API_KEY:API_SECRET).

Request Examples

Code
 
# First, encode your credentials
CREDENTIALS=$(echo -n "your_api_key:your_api_secret" | base64)

# Then use the encoded credentials in your request
curl -X GET "https://inradar.com.br/public/v1/people/" \
  -H "Authorization: Basic $CREDENTIALS" \
  -H "Content-Type: application/json" \

Code
 
const apiKey = process.env.INCHURCH_API_KEY;
const apiSecret = process.env.INCHURCH_API_SECRET;

// Create Base64 encoded credentials
const credentials = Buffer.from(`${apiKey}:${apiSecret}`).toString('base64');

const response = await fetch('https://inradar.com.br/public/v1/people/', {
  method: 'GET',
  headers: {
    'Authorization': `Basic ${credentials}`,
    'Content-Type': 'application/json',
    'X-API-Version': 'v1'
  }
});

const data = await response.json();

Code
 
import os
import requests
import base64

api_key = os.getenv('INCHURCH_API_KEY')
api_secret = os.getenv('INCHURCH_API_SECRET')

# Create Base64 encoded credentials
credentials = base64.b64encode(f"{api_key}:{api_secret}".encode()).decode()

headers = {
    'Authorization': f'Basic {credentials}',
    'Content-Type': 'application/json',
    'X-API-Version': 'v1'
}

response = requests.get(
    'https://inradar.com.br/public/v1/people/',
    headers=headers
)

data = response.json()

Code
 
<?php
$apiKey = getenv('INCHURCH_API_KEY');
$apiSecret = getenv('INCHURCH_API_SECRET');

// Create Base64 encoded credentials
$credentials = base64_encode($apiKey . ':' . $apiSecret);

$headers = [
    'Authorization: Basic ' . $credentials,
    'Content-Type: application/json',
    'X-API-Version: v1'
];

$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, 'https://inradar.com.br/public/v1/people/');
curl_setopt($ch, CURLOPT_HTTPHEADER, $headers);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);

$response = curl_exec($ch);
$data = json_decode($response, true);
curl_close($ch);
?>

Authentication Errors

Common Error Responses

Example Error Response

Code
 
{
  "error": {
    "code": "UNAUTHORIZED",
    "message": "Invalid API credentials",
    "details": {
      "reason": "API secret does not match"
    }
  }
}

Best Practices

Security

• ✅ Store credentials in environment variables
• ✅ Use HTTPS for all requests
• ✅ Rotate API secrets regularly
• ✅ Monitor API usage logs
• ❌ Never commit credentials to version control
• ❌ Don't share API secrets via email or chat

Performance

• ✅ Reuse connections when possible
• ✅ Implement proper error handling and retries
• ✅ Respect rate limits
• ✅ Cache responses when appropriate

Troubleshooting

Testing Your Credentials

Use this simple test to verify your authentication:

Code
 
# Encode your credentials
CREDENTIALS=$(echo -n "YOUR_API_KEY:YOUR_API_SECRET" | base64)

curl -X GET "https://inradar.com.br/public/v1/people?limit=1" \
  -H "Authorization: Basic $CREDENTIALS" \
  -H "Content-Type: application/json" \
  -H "X-API-Version: v1"

Common Issues

1. 401 Unauthorized: Check your API key and secret, and ensure they're properly Base64 encoded
2. 403 Forbidden: Verify your client has the required permissions
3. Invalid scope: Ensure you're accessing resources within your scope level