Start

Authentication

Every request (except /v1/ping) must carry an API key. Send it in the Authorization header as a bearer token:

HTTP header

Authorization: Bearer ak_live_Xb8wQ2mR4tY7uI0pA3sD6fG9hJ1kL5zC

If your HTTP client cannot set Authorization, you can send the same value in an X-Api-Key header instead. Never put the key in the URL: URLs end up in logs.

Key format

Prefix	Mode	What it reads
`ak_test_`	Test	Real catalog, fake account data. Works while your app is pending.
`ak_live_`	Live	Your real account. Works only after your app is approved.

Every response has meta.mode so your code can tell which one answered.

Permissions (scopes)

When you create a key you pick which data it may read. A call to an endpoint outside the key's permissions fails with insufficient_scope and names the missing permission in error.required_scope.

Permission	Gives access to
`catalog:read`	Products, categories, prices and public news.
`account:read`	Your profile: nickname, plan, level, linked logins.
`balance:read`	Your balance and balance history.
`orders:read`	Your store orders (order info only, never the delivered items).
`licenses:read`	Your VIP / LITE plan and expiry.
`boost:read`	Your Hour Boost plans, hours and status.
`notifications:read`	Your site notifications.

A key can only get permissions that were granted to its app. Ask for the smallest set you need: it makes review faster and a leaked key less harmful.

Whose data a key reads

In v1 a key always acts as the account that created it. There is no way to read another user's data. Signing in other users with "Login with Adolfjon" is planned for a later version.

Browser apps

The API does not send CORS headers. Call it from your server, bot or script, never from JavaScript in a public web page: anyone could copy the key from the page.