Authentication
The Virtimo BPC API offers various options for authenticating when calling endpoints. Depending on the use case and system configuration, different methods are available to ensure secure access. This page provides an overview of the supported authentication methods and their primary uses.
Available Authentication Methods
The BPC supports three basic types of authentication for the API. Select the appropriate method based on your system environment and security requirements.
API Keys
An API key corresponds to a static session in the BPC and contains attributes such as assigned organizations, roles, and permissions.
This method is recommended by default for calling API endpoints as well as for configuring deployment systems.
Authentication takes place directly when the API is called by passing the key in the HTTP header X-APIKey.
For more information and configuration details, see API Keys.
User Login
In addition to API keys, you can also access the BPC API using traditional login credentials (username and password). Without an API key, this method requires a separate authentication call before accessing any API function. Please note that this type of login cannot be used if an OIDC-based identity provider is in use. For more information and a sample procedure, see API Authentication via User Login.
