Authentication

Every request must include an API key. Each API accepts a slightly different set of headers.

API Store
User API
qPapel Protection

Send your secret key (psa_...) as a Bearer token or in the X-API-Key header.

# Preferred
Authorization: Bearer psa_your_api_key

# Alternative
X-API-Key: psa_your_api_key

Send your API key and your store hash on every request.

x-api-key: your_api_key
x-store-hash: your_store_hash

Header	Description
`x-api-key`	Your personal API key from dashboard settings.
`x-store-hash`	The unique identifier of your store.

Send your developer key (pk_live_...) in one of three ways.

# Preferred
Authorization: Bearer pk_live_your_key

# Alternative
x-api-key: pk_live_your_key

# Legacy (supported for older loaders)
api-key: pk_live_your_key

Test your credentials

Call the User API connectivity endpoint to confirm your key and store hash work:

curl https://app.papelship.com/api_user/api/v1/test-routing \
  -H "x-api-key: your_api_key" \
  -H "x-store-hash: your_store_hash"

A valid request returns "success": true. An invalid key returns 401 Unauthorized.

Keep your keys safe

Only use keys on your server

API keys grant full access to your store and licenses. Never embed them in frontend JavaScript, mobile apps, or distributed desktop binaries.

Store keys in environment variables

Load keys from environment variables or a secrets manager. Never commit them to source control.

Rotate a leaked key immediately

If a key is exposed, revoke it in the dashboard and create a new one.

Get started

Core concepts

Test your credentials

Keep your keys safe

​Test your credentials

​Keep your keys safe

Test your credentials

Keep your keys safe