GigUp Docs

API

Authentication

Learn how to authenticate API requests using bearer tokens, manage permissions, and handle authentication errors.

The GigUp API uses Bearer Token Authentication. All requests must include a valid API token in the Authorization header.

Creating an API Token

Via Dashboard

  1. Log in to your GigUp dashboard
  2. Navigate to Developer Tools in the dashboard
  3. Click Create Token
  4. Enter a descriptive name (e.g., "Zapier Integration")
  5. Select permissions:
    • Read — Access to GET endpoints
    • Write — Full access including mutations
  6. Click Create

⚠️ Warning: The token is displayed only once. Copy it immediately and store it securely. If lost, you must create a new token.

Token Scopes

Scope Description Endpoints
read Read-only access to all resources All GET requests
write Full CRUD access All POST, PATCH, DELETE

You can assign one or both scopes to a token. Read endpoints accept either scope. Write endpoints require write.

Using Your Token

Include the token in every request:

Authorization: Bearer YOUR_API_TOKEN
Accept: application/json
Content-Type: application/json

Example Request

curl -X GET "https://giguphq.com/api/v1/me" \
  -H "Authorization: Bearer your_api_token_here" \
  -H "Accept: application/json"

Example Response

{
  "data": {
    "id": 1,
    "name": "John Doe",
    "email": "[email protected]",
    "current_team_id": 5
  }
}

Verifying Your Token

Test your token with the /me endpoint:

curl -X GET "https://giguphq.com/api/v1/me" \
  -H "Authorization: Bearer YOUR_API_TOKEN"

A successful response confirms your token is valid and active.

Authentication Errors

401 Unauthorized

{
  "message": "Unauthenticated."
}

Causes:

  • Missing Authorization header
  • Invalid token format
  • Token has been deleted

Resolution: Verify your token is included correctly and hasn't been revoked.

403 Forbidden

{
  "message": "This action is unauthorized."
}

Causes:

  • Token lacks the required scope (e.g., using read token for a POST request)
  • User doesn't have permission for the requested resource

Resolution: Check that your token has the write scope for mutation requests.

Token Management

Listing Tokens

View all your active tokens from the Developer Tools page. Each token shows:

  • Name
  • Scopes (permissions)
  • Last used time
  • Creation date

Revoking Tokens

To revoke a token:

  1. Go to Developer Tools in your dashboard
  2. Find the token you want to revoke
  3. Click Delete

⚠️ Warning: Revoked tokens are immediately invalidated. Any integrations using that token will stop working.

Security Best Practices

  1. Use environment variables — Never hardcode tokens in your source code
  2. Use descriptive names — Name tokens by their purpose (e.g., "Production Webhook")
  3. Rotate regularly — Delete old tokens and create new ones periodically
  4. Use minimal scopes — Only grant the permissions each integration needs
  5. Monitor usage — Check the "Last used" timestamp to detect unauthorized access

Store Your Integration Token

Store your GigUp token in your own application’s environment, then read it when making API requests.

# Your integration’s environment
GIGUP_API_TOKEN=your_api_token_here
# Python
import os
import requests

token = os.getenv('GIGUP_API_TOKEN')
headers = {'Authorization': f'Bearer {token}'}

response = requests.get('https://giguphq.com/api/v1/jobs', headers=headers)
// Node.js
const token = process.env.GIGUP_API_TOKEN;

fetch('https://giguphq.com/api/v1/jobs', {
  headers: { 'Authorization': `Bearer ${token}` }
});