The Brooklyn API does not use static API keys. Every request is made on behalf of a real Brooklyn user and is signed with short-lived credentials, so access follows the user's permissions and ends when their account is disabled.
1. Sign in. The user signs in through the environment's Brooklyn login (username and password, multi-factor authentication or the organisation's single sign-on). A successful sign-in returns an ID token, valid for one hour, and a refresh token that can be exchanged for new ID tokens.
2. Exchange the ID token for temporary credentials. The ID token is exchanged with the environment's identity service for temporary AWS credentials (access key, secret key and session token), scoped to calling the Brooklyn API only.
3. Sign each request with AWS Signature Version 4 for the execute-api service, in the environment's region. The AWS SDKs and most HTTP tooling (for example Postman's "AWS Signature" authorisation type) can do this for you.
POST /api-v2/contracts/list HTTP/1.1
Host: {your Brooklyn API address}
Content-Type: application/json
X-Amz-Date: 20260929T101500Z
X-Amz-Security-Token: {session token}
Authorization: AWS4-HMAC-SHA256 Credential={access key}/20260929/{region}/execute-api/aws4_request, SignedHeaders=content-type;host;x-amz-date;x-amz-security-token, Signature={signature}The identity settings for an environment (region, user pool and identity pool) are provided by Brooklyn when API access is enabled.