Skip to main content
All API requests must include your API key. There are two ways to pass it: 
Authorization: Bearer sk_staging_your_api_key_here

​
API Key Header

x-api-key: sk_staging_your_api_key_here

​
API Key Format

EnvironmentPrefixExample
Stagingsk_staging_sk_staging_abc123def456...
Productionsk_live_sk_live_abc123def456...

​
How It Works

  1. The API extracts your key from the Authorization or x-api-key header
  2. The first 16 characters are used to look up your partner account
  3. The full key is verified against the stored hash using bcrypt
  4. Validated keys are cached for 5 minutes to reduce latency on subsequent requests

​
What Gets Attached

On successful authentication, the API attaches your partner context to the request. This includes your partner ID, fee configuration, and a data filter that scopes all queries to your account.

​
Error Responses

401 — Missing or invalid API key
{
  "status": "error",
  "message": "Unauthorized",
  "data": {
    "error": "Invalid API key"
  }
}
403 — Partner suspended
{
  "status": "error",
  "message": "Forbidden",
  "data": {
    "error": "Partner account is suspended"
  }
}
Keep your API key secret. Do not expose it in client-side code, public repositories, or logs. If compromised, contact support immediately to rotate it.