Authentication & Tokens

ICDC uses scoped API tokens to authenticate requests to vendor data sources via the ICDC proxy.

Obtaining a token

1. Sign in to the Developer Portal.
2. Find the data source in the Catalog and request access.
3. After approval by your Organization, a token appears under the data source’s Developer Portal section.

Using a token

Send your token in the X-Api-Key header when calling the ICDC proxy hostname for that data source.

curl -H "X-Api-Key: <icdc-token>" https://<proxy-hostname>/...
``

In Node.js:

```javascript
const res = await fetch("https://<proxy-hostname>/...", {
  headers: { "X-Api-Key": process.env.ICDC_TOKEN }
});

Scopes & access

• Tokens are scoped per data source and Organization.
• Access is enforced server‑side; vendor credentials are never exposed to clients.

Rotation & hygiene

• Rotate tokens on staff changes or when automating CI/CD.
• Store tokens in secure secret stores (e.g., cloud secret managers).
• Avoid embedding tokens in source control or client‑side apps.