Authentication

Overview

The 9Squid API uses Bearer token authentication. Every request must include a valid API key in the Authorization header. Requests made without a token — or with an invalid one — will be rejected with a 401 Unauthorized response.

Step 1 — Request an API Key

API keys are provisioned manually. To get one, send an email to: support@9squid.com Include the following in your request:

Field	Description
Name	Your full name
Organization	Company or team name
Role	`Originator`, `Investor`, or `Both`
Environment	`Development`, `Staging`, or `Production`
Use case	Brief description of what you are building

The team will provision your key and reply with your credentials. Keys are environment-specific — a development key will not work against the production base URL.

Step 2 — Pass the Key as a Bearer Token

Once you have your API key, include it in the Authorization header of every request:

Authorization: Bearer <your_api_key>

Example — cURL

curl -X GET "https://api.9squid.com/v1/api/deals" \
  -H "Authorization: Bearer <your_api_key>" \
  -H "Content-Type: application/json"

Example — JavaScript (fetch)

const response = await fetch('https://api.9squid.com/v1/api/deals', {
  method: 'GET',
  headers: {
    'Authorization': 'Bearer <your_api_key>',
    'Content-Type': 'application/json'
  }
});

Example — Python (requests)

import requests

headers = {
    'Authorization': 'Bearer <your_api_key>',
    'Content-Type': 'application/json'
}

response = requests.get('https://api.9squid.com/v1/api/deals', headers=headers)

Token Scopes

Your API key is tied to a specific role. Calling an endpoint outside your role returns 403 Forbidden.

Role	Access
Originator	Loan management, pools, selection criteria, deal room documents, analytics
Investor	Deal marketplace, portfolio, subscriptions, allocations, reports
Both	Alerts, webhooks

If you receive a 403 on an endpoint you expect to access, verify your role with support@9squid.com.

Authentication Errors

Status Code	Cause	Fix
`401 Unauthorized`	Missing or malformed `Authorization` header	Ensure the header is present and formatted as `Bearer <token>`
`401 Unauthorized`	Invalid or expired API key	Contact support@9squid.com to rotate your key
`403 Forbidden`	Valid token but insufficient role permissions	Confirm your role covers the endpoint you are calling

Security Best Practices

Never expose your API key in client-side code (browser JavaScript, mobile apps). Always proxy requests through your backend.
Store keys in environment variables or a secrets manager — not in source code or version control.
If you suspect your key has been compromised, contact support@9squid.com immediately to have it rotated.

Support

For API key requests, rotations, or access issues contact support@9squid.com. Check status.9squid.com for current platform status and incident history before opening a ticket.

​Overview

​Step 1 — Request an API Key

​Step 2 — Pass the Key as a Bearer Token

​Example — cURL

​Example — JavaScript (fetch)

​Example — Python (requests)

​Token Scopes

​Authentication Errors

​Security Best Practices

​Support