Coming September 28, 2026:
As part of our ongoing security hardening, we're tightening the authentication requirements on the user export endpoint:
POST /v2/users/exportGET /v2/users/export(legacy)
What's changing
Starting Sept 28, 2026, these endpoints will require an authenticated admin credential on every request. Requests that rely only on a client feature token — with no authenticated admin user behind them — will start receiving a 401 Unauthorized.
Who this affects
Any script, custom integration, or automation that calls the user export endpoint without an authenticated admin API key. This does not affect exports triggered through the admin dashboard, the import/export task queue, or managed integrations.
What to do
Check your integration. If the code or script that calls
/v2/users/exportsends only a client/site token — and noAuthorizationheader tied to a logged-in admin — it will be affected.Enable API Key authentication (if not already on). Go to Settings > Manage Users > Security. Under Internal Authentication Settings, confirm API Key is enabled as an authentication method. If it's off, the Security tab shows a warning telling you so.
Generate an admin API key. On that same Security tab, find the Your API Keys card and click New API Key. Copy the generated key immediately — it's shown only once.
Confirm that admin account has export permission. Go to Settings > Manage Users > Permission Groups and make sure the admin's Permission Group includes a Role granting Import/Export access (look for Access Import/Export or Administer Import/Export under the Data section).
Update your integration to send
Authorization: Bearer <your API key>on export requests.Test before Sept 28.