Authentication overview

Feedbin provides programmatic access to its features, including feed management, article retrieval, and subscription handling, through its developer API. Access to this API is contingent on proper authentication, which verifies the identity of the requesting client or application. Feedbin's API primarily utilizes Basic Authentication over HTTPS, ensuring that credentials are encrypted during transit to prevent interception.

Basic Authentication is a straightforward scheme where the client sends HTTP requests with an Authorization header containing the word Basic followed by a space and a base64-encoded string of the username and password joined by a colon (username:password). While simple, its security heavily relies on the underlying transport layer. For Feedbin, this means all API interactions must occur over HTTPS, which encrypts the entire communication channel, protecting the transmitted credentials and data from eavesdropping. The Feedbin API documentation provides a detailed guide for developers building custom integrations and clients using this authentication approach.

Developers interacting with the Feedbin API should understand the implications of Basic Authentication, particularly regarding credential storage and handling. Unlike token-based methods such as OAuth 2.0, which can provide granular permissions and revoke access without changing primary user credentials, Basic Authentication directly uses the user's primary login. This design choice simplifies integration for many common use cases but necessitates careful credential management by the integrating application.

Supported authentication methods

Feedbin's API exclusively supports Basic Authentication for authenticating API requests. This method is integrated into the HTTP protocol itself, making it widely compatible with various programming languages and HTTP client libraries. The following table summarizes its characteristics:

Method When to Use Security Level
Basic Authentication Programmatic access, custom clients, server-side integrations, scripts requiring full account access. High (when used over HTTPS/TLS)

When implementing Basic Authentication, the client constructs an HTTP header in the format Authorization: Basic <credentials>. The <credentials> part is the base64 encoding of username:password, where the username is the email address associated with the Feedbin account and the password is the account's password. It's important to recognize that while base64 encoding obfuscates the credentials, it does not encrypt them. Therefore, the absolute requirement for HTTPS is critical for the security of this authentication method. Without HTTPS, credentials would be transmitted in plain text, making them vulnerable to interception during network transfers, as detailed in the RFC 7617 HTTP Basic Authentication Scheme specification.

The Feedbin API is designed for applications needing direct, full access to a user's Feedbin account. For scenarios requiring more limited access or delegated authorization without sharing primary credentials, alternative authentication flows like OAuth 2.0 are typically used by other services. However, for Feedbin's current API, Basic Authentication is the canonical method.

Getting your credentials

To authenticate with the Feedbin API, you need your Feedbin account's registered email address (username) and password. These are the same credentials you use to log into the Feedbin web interface. There are no separate API keys or tokens to generate for Basic Authentication, simplifying the setup process for developers.

  1. Account Creation: If you do not have a Feedbin account, you must first create one and subscribe to a paid plan. Feedbin offers a monthly or annual subscription.
  2. Retrieve Username: Your username for API access is the email address you used to register for your Feedbin account.
  3. Retrieve Password: Your password is the one you set during account creation or any subsequent password changes. There is no special API password; it's your primary account password.
  4. No API Key Generation: Unlike many other APIs, Feedbin does not require you to generate a separate API key or token within your account settings for Basic Authentication. The system relies directly on your login credentials.

It is crucial to keep these credentials secure, as they grant full access to your Feedbin account. Treat them with the same level of security as you would your financial login information. Do not embed them directly into client-side code, public repositories, or unencrypted configuration files. For server-side applications, use environment variables or secure secret management systems to store and retrieve credentials.

Authenticated request example

Once you have your Feedbin username (email) and password, you can construct an authenticated API request. The following example demonstrates how to fetch a user's subscriptions using the curl command-line tool. Replace YOUR_EMAIL and YOUR_PASSWORD with your actual Feedbin credentials.

curl -u "YOUR_EMAIL:YOUR_PASSWORD" \
     -H "Content-Type: application/json" \
     "https://api.feedbin.com/v2/subscriptions.json"

In this example:

  • curl -u "YOUR_EMAIL:YOUR_PASSWORD": The -u flag tells curl to use Basic Authentication with the provided username and password. curl automatically base64-encodes these credentials and adds the appropriate Authorization header.
  • -H "Content-Type: application/json": Specifies that the request body (though not present in this GET request) expects and sends JSON.
  • "https://api.feedbin.com/v2/subscriptions.json": The API endpoint for retrieving subscriptions.

The Feedbin API documentation on the Feedbin developers page defines available endpoints and expected responses. For instance, a successful request to the /v2/subscriptions.json endpoint would return a JSON array of subscription objects, each containing details like the feed's title, URL, and a unique ID. If authentication fails, the API will typically return an HTTP 401 Unauthorized status code. Always verify the status code of your responses to handle authentication errors gracefully.

Programming language examples:

Python

import requests

FEEDBIN_EMAIL = "YOUR_EMAIL"
FEEDBIN_PASSWORD = "YOUR_PASSWORD"

url = "https://api.feedbin.com/v2/subscriptions.json"

try:
    response = requests.get(url, auth=(FEEDBIN_EMAIL, FEEDBIN_PASSWORD))
    response.raise_for_status() # Raise an exception for HTTP errors (4xx or 5xx)
    subscriptions = response.json()
    for sub in subscriptions:
        print(f"Feed ID: {sub['feed_id']}, Title: {sub['title']}")
except requests.exceptions.HTTPError as e:
    print(f"HTTP Error: {e}")
    print(f"Response content: {e.response.text}")
except requests.exceptions.RequestException as e:
    print(f"Request Error: {e}")

JavaScript (Node.js using node-fetch)

import fetch from 'node-fetch';

const FEEDBIN_EMAIL = "YOUR_EMAIL";
const FEEDBIN_PASSWORD = "YOUR_PASSWORD";

const credentials = Buffer.from(`${FEEDBIN_EMAIL}:${FEEDBIN_PASSWORD}`).toString('base64');

const url = "https://api.feedbin.com/v2/subscriptions.json";

async function getSubscriptions() {
    try {
        const response = await fetch(url, {
            headers: {
                'Authorization': `Basic ${credentials}`,
                'Content-Type': 'application/json'
            }
        });

        if (!response.ok) {
            const errorText = await response.text();
            throw new Error(`HTTP Error: ${response.status} - ${errorText}`);
        }

        const subscriptions = await response.json();
        subscriptions.forEach(sub => {
            console.log(`Feed ID: ${sub.feed_id}, Title: ${sub.title}`);
        });

    } catch (error) {
        console.error(`Error fetching subscriptions: ${error.message}`);
    }
}

getSubscriptions();

Security best practices

When working with Feedbin's Basic Authentication, adhering to security best practices is essential to protect your account and data. Since this method transmits your primary login credentials, careful handling is paramount.

  • Always Use HTTPS: This is a non-negotiable requirement. Ensure all API requests are made over HTTPS to encrypt the communication channel. Feedbin's API endpoints automatically enforce this, but it's a fundamental principle for any Basic Authentication implementation. Without HTTPS, your username and password would be sent in plain text, making them vulnerable to network sniffers.
  • Secure Credential Storage: Never hardcode credentials directly into your application's source code, especially if it's client-side or publicly accessible. For server-side applications, use environment variables, secret management services (e.g., AWS Secrets Manager, Google Secret Manager), or secure configuration files that are not committed to version control. Avoid storing credentials in plain text.
  • Limit Access and Scope: While Basic Authentication grants full account access, design your application to perform only necessary actions. Minimize the lifetime of credentials in memory where possible.
  • Error Handling: Implement robust error handling for authentication failures (e.g., HTTP 401 Unauthorized responses). Distinguish between temporary network issues and genuine authentication problems. Avoid logging sensitive information, such as passwords, in error messages.
  • Regular Password Changes: Periodically change your Feedbin account password, especially if you suspect any compromise or if you've integrated with a new application. This practice is a general security recommendation for all online accounts.
  • Protect API Calls from Interception: Be cautious about making API calls from untrusted networks. While HTTPS encrypts the payload, sophisticated attacks could still target endpoints. Ensure your application's network environment is secure.
  • Avoid Client-Side Exposure: Do not embed your Feedbin credentials directly into client-side JavaScript or mobile applications where they could be easily extracted by end-users. If building a client-side application that needs to interact with Feedbin, consider routing requests through a secure backend proxy that handles authentication on the server side, mediating between your client and the Feedbin API. This way, your credentials remain on a controlled server. The OAuth 2.0 specification outlines various secure authorization flows, which, while not directly supported by Feedbin's API, illustrate principles of secure delegated access.
  • Monitor for Suspicious Activity: Keep an eye on your Feedbin account for any unexpected activity if you have integrated it with external services. Promptly revoke access or change passwords if anything seems amiss.