API Authentication
All requests to the Demi API must be authenticated using an API key.
Sending Your API Key
You can include your API key in requests using either method:
Option 1: X-API-Key Header (Recommended)
curl https://api.getdemi.co/api/v1/products \
-H "X-API-Key: pk_your_api_key_here"Option 2: Bearer Token
curl https://api.getdemi.co/api/v1/products \
-H "Authorization: Bearer pk_your_api_key_here"API Key Format
All Demi API keys follow a specific format:
- Start with
pk_prefix - Followed by 64 hexadecimal characters
- Example:
pk_a1b2c3d4e5f6...
API Scopes
API keys are granted specific scopes that control what operations they can perform:
| Scope | Description | Endpoints |
|---|---|---|
customers:read |
Read customer data | GET /api/v1/customers |
customers:write |
Create, update, delete customers | POST, PUT, DELETE /api/v1/customers |
orders:read |
Read order data | GET /api/v1/orders |
orders:write |
Create, update, cancel orders | POST, PUT, DELETE /api/v1/orders |
products:read |
Read product catalog | GET /api/v1/products |
Security Best Practices
Never expose your API key in client-side code. API keys should only be used in server-to-server communication.
- Use environment variables - Store keys in environment variables, not source code
- Limit scope - Only request the scopes you need
- Rotate regularly - Rotate API keys every 90 days
- Revoke unused keys - Immediately revoke keys that are no longer needed
- Use separate keys - Use different keys for development and production
Key Management
You can manage your API keys from the Demi dashboard:
- Create - Generate new keys with specific scopes
- View - See key metadata and usage statistics
- Rotate - Generate a new key while keeping the same ID and scopes
- Revoke - Immediately disable a key
- Delete - Permanently remove a key