Skip to content
Sales Docs
Start free

Help · For developers

Authentication

Every public API request is authenticated with a workspace API key. The key identifies your workspace — treat it like a password.

Creating a key

  1. In the app, open Settings, then API keys.
  2. Choose New key, give it a Name (e.g. "Landing page") and choose Create key.
  3. Copy it immediately with Copy key — the full key is shown only once. If you lose it, revoke it and create a new one.

Keys can be revoked at any time from the same page with Revoke; a revoked key stops working instantly. Hustler allows 2 active keys; Growth and above are unlimited.

The Access choice on a new key (Full access, Read only or Choose) is recorded but not enforced yet. Every key can currently read and create orders.

Sending the key

Pass the key on every request in either of these headers:

Authorization: Bearer YOUR_API_KEY

or

X-API-Key: YOUR_API_KEY

Authorization: Bearer is the recommended form.

Example

curl https://sales.api.kushi.ng/public/v1/products \
  -H "Authorization: Bearer YOUR_API_KEY"

A missing or invalid key returns 401:

{ "error": "invalid or missing API key" }

Keep keys server-side where you can. Anyone who has a key can list your orders, including buyers' phone numbers and addresses. If a key must live in browser code (e.g. a static landing page), use a separate key for it and revoke it if it's ever misused.