Skip to main content

API key

Your API key is the single credential that identifies your account on every request and fences every response to your own data.

Each client account has one API key. You send it on API calls, and Paylode resolves it to your account so your responses are scoped to that account — your perk collections, your campaigns, your conversions. There's no per-user credential: a single key represents the whole account. Account-scoped endpoints still take your account id in the path; the key is what authenticates you for it.

This page explains what the key is and how it behaves. For the step-by-step of sending it on a call, see Authentication.

How it works​

The key is a secret string. Treat it like a password: keep it server-side, out of client code and out of logs, and don't commit it to source control.

You attach it to every request in the X-API-Key header. Header-name matching is case-insensitive, but keep the value exactly as issued.

Because the key maps straight to your account, a request either authenticates or it's rejected — a missing or unrecognized key returns an authentication error.

note

Keys are static — there's no self-serve rotation today. If you need a key reissued (for example, if you suspect it's been exposed), that's handled through your Paylode contact rather than through the app. Plan your storage so a key can be swapped without a code change.

In the API​

You can look up your account's current key with getApiKey, authenticating with the key you already hold:

curl https://client.paylode.com/client/13/api-key \
  -H "X-API-Key: 6341c870-c23a-11ec-a6d6-0800200c9a66"

The response is your key as a plain string — a UUID:

"6341c870-c23a-11ec-a6d6-0800200c9a66"

You'll also find the key in the Paylode app under your account's integration settings, on the tab that exposes API credentials. The operation reference is on developers.paylode.com.