The API authenticates with a key you pass on every request. Keys are issued from
your reseller dashboard and shown in full only once, at creation.
Passing the key
Send the key in the X-API-Key header:
A Bearer token is also accepted:
Keys are prefixed by environment: sc_live_ for production, sc_test_ for the
sandbox. The prefix and the last four characters are shown in your dashboard so you
can recognise a key without it being re-displayed.
Treat a key like a password. It is shown once. If it leaks, revoke it from the
dashboard and issue a new one — revocation is immediate.
Scopes
A key carries scopes that bound what it can do: catalog:read, orders:read,
orders:write, wallet:read, webhooks:manage. Issue a narrow key for a narrow
job; a request beyond a key’s scopes is refused with 403 forbidden.
IP allowlisting
A key can be locked to a set of IP addresses or CIDR ranges. A request from any
other address is refused. Leave the allowlist empty to accept any address. Our
outbound webhook deliveries come from a fixed IP, which we publish so you can
allowlist us in turn.