Authentication

Every API request requires a valid API key. Keys are tied to a specific tenant and have scopes that determine which endpoints they can call.

Key format

• Live keys start with spk_live_ — hit real production data
• Test keys start with spk_test_ — hit production infra but flag orders as test, skip real payments and emails

Example: spk_live_a1b2c3d4e5f6...

How to send your key

Use either header — the API accepts both:

Authorization header (recommended):

Authorization: Bearer spk_live_xxxxxxxxxxxxxxxx

X-API-Key header:

X-API-Key: spk_live_xxxxxxxxxxxxxxxx

Creating a key

1. Log in to the Spectra admin
2. Go to Commerce → API Keys
3. Click Generate Key
4. Choose a label, environment (Live or Test), rate tier, and scopes
5. Copy the key — it is shown only once

If you lose a key, revoke it and create a new one.

Scopes

Each scope grants access to a specific area of the API. A key only works on endpoints matching its scopes.

Tip: Give each integration the minimum scopes it needs. If your integration only reads products, it should have catalog:read — nothing else.

Revoking a key

Revoked keys stop working immediately. There is no undo.

1. Go to Commerce → API Keys
2. Click the key's label to open the detail view
3. Click Revoke Key

Error responses