Authentication

Every call to /v1 carries the API key as a bearer token:

curl $BACKEND_URL/v1/sellers \
  -H "Authorization: Bearer mk_your_api_key"

The Bearer prefix (with a space) is required.

The API keyCopy Anchor Link

• Created in the dashboard, under API keys. Create as many as you need, one per system.
• Format: mk_ followed by 32 characters, like mk_AbCd1234…. The first 8 of those 32 are the prefix, which identifies the API key in the dashboard list.
• Shown once, when created. If you lose it, create another.
• Can be revoked at any time. From then on it stops working.
• Identifies your account. You only see the sellers and data of your own account.

Treat the API key like a password: keep it out of source code and the front end. If it leaks, revoke it.

Try it in the playgroundCopy Anchor Link

Every endpoint page has a playground:

1. In the Authorization field, paste the API key after Bearer , like this: Bearer mk_your_api_key.
2. Fill in the other fields and send.

The playground calls the real API: a POST creates the resource in your account.

Your browser saves the API key and fills in the field on the other endpoint pages. On a shared computer, clear the field when you're done.

Missing, invalid or revoked API keyCopy Anchor Link

HTTP/1.1 401 Unauthorized

{
  "error": {
    "code": "UNAUTHORIZED",
    "message": "Missing, invalid or revoked API key."
  }
}

Full error format in Errors.