Authentication

Server-to-server integrations authenticate with an API key. The dashboard uses short-lived portal tokens. Both identify your organization and scope what a request can do.

API keys

Create and manage keys under Settings → API keys. Send your key in the X-Api-Key header on every request:

bash

curl "https://api.getauthorigin.com/api/v1/products" \
  -H "X-Api-Key: $AUTHORIGIN_KEY"

A key may also be supplied as a bearer token — Authorization: Bearer ak_live_xxx — if that fits your HTTP client better. The two are equivalent for API keys.

Treat keys like passwords

Keys are shown in full only once, at creation. Store them in a secret manager, never in client-side code or version control. If a key leaks, revoke it immediately.

Scopes

Each key is granted a set of scopes that limit what it can do — grant only what an integration needs. A request lacking the required scope returns 403 with code INSUFFICIENT_SCOPE. Typical scopes include:

products.read / products.write — read or manage products
batches.write and barcodes.generate — create batches and mint codes
product_units.write — activate, suspend or recall units
analytics.read and scans.read — read scans and analytics
webhooks.write — manage webhook endpoints

Rotation & revocation

Keys can be rotated without downtime and revoked when no longer needed:

POST /api/v1/api-keys/{id}/rotate — issues a new secret for the same key
POST /api/v1/api-keys/{id}/revoke — disables the key immediately

Portal tokens

The web dashboard signs users in and calls the API with a short-lived JWT access token in the Authorization: Bearer header, refreshed automatically. This flow is for interactive users — for your own backend integrations, use an API key.

Public endpoints

A few endpoints need no authentication because they're used by the public: product verification (GET /v/{token}), consumer counterfeit reports, sign-up, and the contact form. These are rate-limited by IP — see Errors & rate limits.

NextWebhooks →