The Stell API authenticates with API keys. You create and manage keys in the merchant portal. See API keys for creating, rotating, and revoking them.
Keys start with sk_prod_ followed by a random string. The full secret is shown once, when you create the key.
Sending your key
Pass the key as a Bearer token in the Authorization header on every request:
A missing or invalid key returns 401 Unauthorized. A valid key requesting a resource that belongs to another company returns 403 Forbidden.
Keep keys server-side
An API key grants full read and write access to your company’s data,
including issuing and voiding passes on customers’ devices. Treat it like a
password. Call the API from your servers only, and never embed a key in a
website, mobile app, or anything else you ship to users.
- Use one key per integration. Revoking one then never breaks the others.
- Store keys in your secrets manager, not in code or config files under version control.
- If a key may have leaked, rotate it immediately. The old secret stops working at once.
