Authentication

Create API keys in the dashboard. Public API endpoints accept either header:


Authorization: Bearer sk-…


x-api-key: sk-…

Use Authorization unless an SDK specifically expects x-api-key. Both forms identify the same account and spend the same prepaid balance.

Keep keys server-side

An API key is a spendable secret. Never include it in browser JavaScript, mobile binaries, public repositories, URLs, logs, screenshots, or support messages. Calls from a client application should pass through your backend.


const response = await fetch("https://api.api-stock.com/api/v1/catalog", {
  headers: { Authorization: `Bearer ${process.env.API_STOCK_KEY}` },
});

Rotate a key

Generate a replacement in the dashboard, deploy it, verify traffic, then revoke the old key. Revocation applies to new authenticated requests.

Authentication errors

HTTP	Code	Meaning
401	`api_key_missing`	No supported key header was sent.
401	`api_key_invalid`	The key is unknown, inactive, deleted, or belongs to a banned account.
401	`auth_required`	The request resolved no authenticated account.

Do not retry an unchanged 401 request. Correct or replace the key first.