---
description: "Authenticate server requests with Paydro organizer credentials over HTTPS."
group: "Get started"
order: 2
---

# Authentication

Authenticate server requests with Paydro organizer credentials over HTTPS.

Organizer API requests use HTTP Basic authentication with an active Paydro organizer account. The username is the account email address and the password is the account password. Requests retain the user’s company and event rights. The reference marks exceptions: [public stage reads](/en-us/docs/stages.md) and [bearer download links](/en-us/docs/files-and-exports.md) do not require Basic credentials. Treat bearer links as secrets: anyone with an eligible link can use it.

## Send credentials {#send-credentials}

Send `Authorization: Basic …` over HTTPS. Your HTTP client encodes `email:password` in Base64; this encoding is not encryption. Use the client’s Basic authentication option instead of building a URL containing a password.

```curl
curl --user "$PAYDRO_EMAIL:$PAYDRO_PASSWORD" \
  --header 'Accept: application/json' \
  "$PAYDRO_ORIGIN/api/v2/events/$EVENT_ID"
```

The reference declares an OpenAPI HTTP Basic security scheme. Public documentation and the specification download do not require authentication. Paydro API credentials belong on the service host, not this developer site.

## Account access {#account-access}

The account must be active, not deleted, and authorized for the organization and event. A normal organizer browser session is separate from a server request with Basic authentication. Verify your integration credentials directly with an authorized read request.

## Failed authentication {#failed-authentication}

Incorrect Basic credentials return a legacy `403` response containing `status`, `title`, and `detail`. Repeated failed attempts may be rate limited. Missing authentication can produce a login redirect or a legacy JSON error; treat either as an authentication failure, even if the final response is `200`.

## Store secrets safely {#store-secrets-safely}

Keep credentials in your server environment or secret manager and exclude Authorization headers from logs. Coordinate account password changes with every integration using that account: update its stored secret and verify an authorized read request after the change. This API does not provide a self service API key or Paydro OAuth token flow through this portal.