Authentication

Authenticate your API requests using API keys. Learn about key types, security best practices, and how to handle authentication errors.

Code example

Authentication

curl -X GET 'https://api.trakkr.ai/get-brands' \
  -H "Authorization: Bearer $TRAKKR_API_KEY"

Error Response · 403 Forbidden

{
  "detail": "Invalid API key"
}

Synthetic example. Values are made up.

API Keys

The Trakkr API uses API keys to authenticate requests. You can view and manage your API keys from your account settings.

REST API access requires the Scale plan or an explicit API entitlement.

Key Format

API keys sk_live_

Reads and writes follow your account’s brand access, role and endpoint requirements.

Using Your API Key

Include your API key in the Authorization header as a Bearer token:

Authorization: Bearer $TRAKKR_API_KEY

All API requests must include a valid API key. Missing or malformed credentials return 401 Unauthorized. An unknown or revoked key returns 403 Forbidden.

Keep your API keys secure. Do not share them in publicly accessible areas such as GitHub, client-side code, or public documentation.

Environment Variables

We strongly recommend storing your API key in an environment variable rather than hardcoding it in your application:

Environment Setup

# Add to your shell profile (~/.bashrc, ~/.zshrc, etc.)
export TRAKKR_API_KEY="sk_live_xxxxxxxxxxxx"

# Then use in requests
curl -H "Authorization: Bearer $TRAKKR_API_KEY" \
  'https://api.trakkr.ai/get-brands'

Security Best Practices

Use environment variables

Never commit API keys to version control. Use .env files and add them to .gitignore.

Rotate keys regularly

Periodically regenerate your API keys, especially if you suspect they may have been compromised.

Each user has one REST key

Generating a replacement invalidates the old key, so update every place that uses it.

Server-side only

Only make API requests from server-side code. Never expose your API key in client-side JavaScript, mobile apps, or browser extensions.

Authentication Errors

Authentication errors return a status code and a JSON detaildescribing the problem:

Status	Error Message	Description
`401`	`Missing API key`	No Authorization header was provided
`403`	`Invalid API key`	The API key doesn't exist or has been revoked

See the Errors reference for a complete list of error codes and how to handle them.

Authentication

curl -X GET 'https://api.trakkr.ai/get-brands' \
  -H "Authorization: Bearer $TRAKKR_API_KEY"

Error Response · 403 Forbidden

{
  "detail": "Invalid API key"
}

Synthetic example. Values are made up.