Authentication - Plazza Developers

Reading the public roadmap needs no token: listing and getting a board’s items, their activity and comments, and its facets under /v1/roadmapBoards/{board}. Every other endpoint asks for a session token. Send it in the Authorization header:

Authorization: Bearer <session token>

A session token comes from a signed-in session in a Plazza app. It lasts about a minute, and the app renews it while the session is open. Keep it in memory, never in logs or URLs.

A session token is the only credential the API accepts today. There are no API keys yet, so only Plazza’s own apps can call the API.

When a token is refused

A request without a usable token answers 401 with the status UNAUTHENTICATED. The error’s reason says why:

Reason	The token
`MISSING_CREDENTIALS`	Is missing.
`NOT_A_SESSION`	Isn’t a session’s, such as a machine token.
`UNTRUSTED_PARTY`	Was issued to a website other than Plazza’s.
`PENDING_SESSION`	Belongs to a sign-in that still has a step to finish.
`UNAUTHENTICATED`	Is expired, malformed or badly signed, or names no account.

A token whose account is closed answers 403 with the status PERMISSION_DENIED and the reason ACCOUNT_DEACTIVATED. See Errors for the full shape.