How you sign in
There is no developer API key. Every developer route answers to the developer console's own session, which is an ordinary UnifyID sign-in.
The console session is the credential
You sign in to the developer console with your own UnifyID — the same account and the same passkey a person uses anywhere else on the platform. The console presents the audience unifyid:developer-console, and the API serves every /v1/developer/** route to developer-console sessions only. A token minted for the person portal or the staff console is refused on them, and the other way round.
The access token the console holds lives for 15 minutes and is renewed by the console from a refresh session kept in __Host- cookies. You never see it, and you never need to.
What the request shapes on this site mean
Where this site shows a /v1/developer/** request, it shows the method, the path and the body — what the developer console sends from the screen named beside it — and no credential. That is deliberate. The route expects a UnifyID access token issued to the developer console, and that is something you cannot mint for a pipeline. Where a sample still spells the header out as authorization: Bearer $UNIFYID_DEVELOPER_TOKEN, that placeholder is the console's own session token and the same applies.
Your own code calls the OAuth and UserInfo routes using the appropriate client credentials and the person's access token.
Some actions ask for your passkey again
Issuing or revoking a client secret, registering a webhook endpoint, and changing a live production application each require a fresh passkey confirmation in the console session. The API answers 403 with a code ending in STEP_UP_REQUIRED; the console handles it by asking you to confirm and returning you to the action.
This is a recovery path, not a denial: you are allowed, you have just not confirmed recently enough. See Errors and refusals.
What this does not do
- No client-credentials grant reaches developer routes. Your application's client id and secret authenticate it at the token endpoint. They do not list your applications or read your webhooks.
- A UnifyID access token issued to another surface does not work here. Audience decides which family of routes a session may reach, and a developer-console session reaches the developer family alone.
Verified against API commit 234dba22 on 2026-10-18. The routes, scopes, checklist, events and limits on these pages are read from that export, not typed.