APIv3
Exit Documentation

Authentication

SalesBinder API v3 uses API keys as Bearer tokens. Every API request must be authenticated.

Bearer authentication

Include your API key in the HTTP Authorization header:

http
Authorization: Bearer YOUR_API_KEY

For example:

bash
curl "https://yourbusiness.salesbinder.com/api/v3/customers" \
  --header "Authorization: Bearer YOUR_API_KEY"

API v3 keys begin with sb_live_. The prefix identifies the value as a SalesBinder API credential; it does not make the key safe to publish.

Key ownership

An API key belongs to the SalesBinder user who created it. Requests made with the key are evaluated using that user's current account, status, and permissions.

Authentication fails if:

  • The key is missing, malformed, invalid, or revoked.
  • The key has expired.
  • The owning user is inactive or deleted.
  • The key no longer belongs to the same account as its user.

An invalid credential returns 401 Unauthorized and includes WWW-Authenticate: Bearer.

json
{
  "error": {
    "type": "authentication_error",
    "code": "authentication_required",
    "message": "A valid API credential is required."
  }
}

Store keys securely

  • Store keys in a secrets manager or protected server-side environment variable.
  • Never embed a key in frontend JavaScript or a mobile application package.
  • Use a separate key for each integration so it can be identified and revoked independently.
  • Give keys descriptive names such as Warehouse integration or Reporting service.
  • Revoke a key immediately if it may have been exposed.

The complete key is shown only at creation time. If it is lost, revoke it and create a replacement.

Revoke a key

Open Profile → API Keys and revoke the affected key. Revocation is immediate and does not change the user's other API keys.