Authentication
Stack uses API Keys to authenticate and approve requests. This key is visible on your developer dashboard
A production API Key will only work in a production environent, and a sandbox API Key will only work in a sandbox environment.
Verifying your authentication
When in doubt, just verify that your API request is properly authenticated by making a GET HTTP request to the /ping endpoint.
Verifying Authentication
curl --location --request GET 'https://api.stack-ft.com/ping' \
--header 'Authorization: sk_adc11964-af08-4c5f-a7d4-f85723f6731a'
Expected response
Assuming your request was properly authenticated and successful, you should get a 200 response status code with the response body:
Expected response
{
"message": "pong"
}
Always keep your key safe and rotate it immediately if you suspect it has been compromised.
Managing and rotating your API keys
You manage your keys from Settings » API Keys in your dashboard. Each account has two keys: a Secret Key for production and a Public Key for the sandbox environment. From this page you can reveal, copy, rotate, and pause either key.
Rotating a key
Rotating a key generates a brand-new key and immediately invalidates the current one. Any integration still using the old key will stop working until you update it with the new value, so plan to update your applications right after rotating. This action cannot be undone.
Rotate a key right away if it has been exposed — for example, committed to a repository, shared in logs, or leaked in a client-side bundle. Rotating is the fastest way to cut off access from a compromised key.
To rotate a key:
- Go to Settings » API Keys.
- Click the rotate (↻) icon next to the Secret or Public key you want to replace.
- Confirm in the dialog. The new key is generated and shown immediately.
- Update every integration that used the old key with the new value.
Pausing a key
If you need to temporarily disable a key without replacing it, use Pause. While a key is paused, all requests made with it are rejected until you unpause it. This is useful when you suspect misuse but aren't ready to rotate and re-deploy. Click Unpause to re-enable the key and resume processing requests normally.
Using an SDK
If you use one of our official SDKs, you won't have to worry about any of the above — fetch your API key from the Stack dashboard under API Keys, and the client library will attach it to your requests for you.