The intSignal API authenticates with bearer tokens. Each token is a scoped API key you create in the Portal and send on every request.
Create an API key
Open API keys
In the Portal, go to Settings → API keys and choose Create key.
Scope it
Grant only the scopes the integration needs (for example soc:read). Least
privilege limits the blast radius if a key leaks.
Copy and store it
The full key is shown once. Store it in a secrets manager or environment variable — never in source control.
Authenticate a request
Send the token in the Authorization header:
curl https://api.intsignal.com/v1/ping \
-H "Authorization: Bearer $INTSIGNAL_TOKEN"
A missing or invalid token returns 401 Unauthorized; a valid token without the
required scope returns 403 Forbidden.
Scopes
Scopes follow a resource:action pattern. Common examples:
| Scope | Grants |
|---|---|
soc:read | Read SOC cases, detections, and data health |
soc:write | Update case status and approve responses |
devices:read | Read monitored device inventory and status |
network:read | Read network and connectivity telemetry |
webhooks:write | Manage webhook subscriptions |
Scopes line up with the product that produces the data — network:read, for
example, reads the connectivity telemetry behind the monitored network inventory
and health view.
Handling keys safely
Warning
Treat API keys like passwords. Do not commit them, embed them in client-side code, or share them between environments. Use a separate key per integration so you can revoke one without breaking the others.
- Rotate keys periodically and immediately if one may be exposed.
- Revoke unused keys in Settings → API keys.
- Prefer short scopes — a reporting job rarely needs write access.
Tokens for AI tools
The MCP server uses the same scoped keys, so an AI assistant only ever sees what its token allows. Issue AI integrations their own read-only key.