Getting started
Authentication
The Products API uses workspace API keys — bearer tokens for server-to-server integrations (the same shape as a HubSpot Private App token).
Issuing a key
- Open Settings → API keys (owner-only — workspace members cannot issue keys).
- Click Issue key, give it a name, and confirm.
- Copy the full key —
alk_live_…— immediately. It is shown once and hashed at rest; it cannot be retrieved again. - Revoke anytime from the same screen.
Store the key as a secret (environment variable or secrets manager). If it is exposed, revoke it and issue a new one immediately.
Sending the key
Include the key on every request in the Authorization header:
Authorization: Bearer alk_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxKey format
Keys are generated as alk_live_ followed by 32 URL-safe base64 characters. The first 16 characters (alk_live_xxxxxxx) are stored as a non-secret prefix so you can identify a key without exposing it.
Scope and limits
- A key is scoped to one workspace — it can never read or write another tenant's data.
- Missing, malformed, or revoked key →
401 Unauthorized. - Issuing and revoking keys is owner-only; workspace members with other roles cannot access this screen.