Skip to main content
The Stell API authenticates with API keys. You create and manage keys in the merchant portal. See API keys for creating, rotating, and revoking them. Keys start with sk_prod_ followed by a random string. The full secret is shown once, when you create the key.

​
Sending your key

Pass the key as a Bearer token in the Authorization header on every request:
A missing or invalid key returns 401 Unauthorized. A valid key requesting a resource that belongs to another company returns 403 Forbidden.

​
Keep keys server-side

An API key grants full read and write access to your company’s data, including issuing and voiding passes on customers’ devices. Treat it like a password. Call the API from your servers only, and never embed a key in a website, mobile app, or anything else you ship to users.
Three habits keep keys manageable:
  • Use one key per integration. Revoking one then never breaks the others.
  • Store keys in your secrets manager, not in code or config files under version control.
  • If a key may have leaked, rotate it immediately. The old secret stops working at once.