> ## Documentation Index
> Fetch the complete documentation index at: https://docs.extrascoop.app/llms.txt
> Use this file to discover all available pages before exploring further.

# API Authentication

> How to authenticate requests to the Extra Scoop Edge API.

You will learn how to secure your programmatic requests to the Extra Scoop platform.

The Extra Scoop API exposes specific edge functions for enterprise newsroom integrations. All requests must be authenticated using standard JSON Web Tokens (JWT) or dedicated edge secrets.

## Bearer Tokens

For user-scoped actions—such as managing your agency profile or interacting with the dealroom—you must include a valid session JWT in the `Authorization` header.

<Note>
  Extra Scoop clients (like the Mobile App and Newsroom Terminal) acquire this JWT securely via the **PKCE (Proof Key for Code Exchange)** flow. Once the PKCE handshake is complete, you use the resulting access token as your Bearer token for all subsequent API calls.
</Note>

<CodeGroup>
  ```bash cURL Example theme={null}
  curl -X POST https://api.extrascoop.app/v1/agency/offers \
    -H "Authorization: Bearer YOUR_SESSION_JWT" \
    -H "Content-Type: application/json" \
    -d '{"scoop_id": "123", "amount": 500}'
  ```
</CodeGroup>

If a token is expired or missing, the API returns a `401 Unauthorized` response.

## Server-to-Server Edge Secrets

If you are configuring a custom webhook receiver or a partner integration (like a certified Silicon Trust™ ingestion node), you authenticate using a static edge secret.

You pass this via the `x-edge-secret` header. You can rotate this secret at any time from your developer dashboard.