Authentication & headers
How to send your API key and what every request needs.
Required headers
| Header | Value | Required |
|---|---|---|
| X-API-Key | YOUR_X_API_KEY | Yes |
| Content-Type | application/json | Yes (POST) |
| Accept | application/json | Recommended |
Managing access
Where keys live
Request and manage API access in Dashboard → API Access. Your key is issued after approval and is scoped to the products you selected.
Pending vs approved
While your request is pending you can read these docs, but purchase and catalog calls are rejected until status is approved.
Server-side only
Call the API from your backend. Never ship the key in client apps, public repos, or front-end bundles.
Authentication errors
| Code | HTTP | Meaning |
|---|---|---|
| UNAUTHORIZED | 401 | Missing or invalid X-API-Key. |
| FORBIDDEN | 403 | API key not permitted for this biller / product, or access not approved. |
| RATE_LIMITED | 429 | Too many requests — back off and retry. |