Authentication

Authentication

Send JSON requests over HTTPS with the complete API key in X-API-Key. Keep it on your server, outside browser code, mobile apps, source control and logs. Do not send an App login token, Bearer token or a separate API secret; these endpoints authenticate only with X-API-Key. OAuth is not currently offered.

Request headers

Content-Type: application/json
X-API-Key: <your-api-key>

Store and manage keys

New keys are shown in full only once, after creation or rotation. The list shows a masked identifier. A lost key cannot be recovered: replace it and revoke the unusable key. The replacement does not automatically receive broader permissions.

New keys default to 365 days. You can choose another future expiry or no expiration. A key with no expiration can still be paused or revoked. Review the expiry in API Keys; automated expiry reminders are not available yet.

Pause temporarily blocks a key and can be reversed. Revoke permanently blocks it. Rotation creates a replacement with the same permissions; move the integration to it before the old key's overlap ends. The default overlap is 24 hours, with a maximum of 7 days; immediate revocation is also available.

Permissions

Get rates

labels.read or labels.buy

Purchase a label

labels.buy

Request label cancellation

labels.buy

These three legacy endpoints retain their existing permissions: labels.read or labels.buy can fetch rates; labels.buy can both buy and cancel labels. Planned labels.void and other new permissions do not replace or expand these grants. Existing keys are not automatically granted new scopes or access to new resources. Only Live keys for the existing endpoints are available; new scoped contracts and test keys remain unavailable.

Response

Responses use { code, message, data }. Check both the HTTP status and response code; provider errors are not successful purchases.