Authentication

Every request carries a store API key. The key decides which store you reach and what you may do there (its permissions).

#Get an API key

1. The store owner signs in to their Elmatajer dashboard.
2. Opens Domains & apps → Public API.
3. Clicks Create key, names it, picks its permissions and — optionally — a webhook URL.
4. The key is shown once. Copy it then; it cannot be shown again (create a new one if it is lost).

A store can hold up to 10 active keys. Revoking a key stops every call with it at once.

#Send the key

Use the Api-Key header:

Api-Key: YOUR_API_KEY

Authorization: Bearer YOUR_API_KEY works the same way.

curl https://elmatajer.com/api/v1/vendor/products \
  -H "Api-Key: YOUR_API_KEY" \
  -H "Accept: application/json"

#Keep it safe

• Use the key only on your server — never in a browser, a mobile app bundle or a public repository.
• Give each partner its own key with only the permissions it needs.
• If a key leaks, revoke it in the dashboard and create a new one.

A missing or revoked key answers 401; a key without the needed permission answers 403 with code: insufficient_scope.