Skip to main content

Authentication - APIv2

Updated

The API keys and headers every Propelus API request requires.

Every request to the Propelus API must be authenticated with two header credentials. There are no unauthenticated endpoints.

Source: https://propelus.com/developer/getting-started/authentication

Required headers

Send both headers on every request:

Header Description
x-api-key Your secret API key. Treat it like a password.
x-client-id Your client identifier. Also used to scope webhook signatures.
Both are required in the header. A request missing either one, or containing an invalid value, results in rejection  before any processing begins.
curl https://api.demo.propelus.com/v2/professions \  
  -H "x-api-key: $PROPELUS_API_KEY" \  
  -H "x-client-id: $PROPELUS_CLIENT_ID"

 

Getting credentials

TBD, API team to confirm. Document how customers obtain their x-api-key and x-client-id (self-serve portal vs. provisioned by Propelus), and whether credentials are issued per environment.

Until that process is documented here, contact support@propelus.com to request or troubleshoot credentials.

Demo vs. production keys

TBD, API team to confirm whether the same credentials work in both Demo and Production, or whether each environment issues its own key pair.

See Environments for the base URLs each environment uses.

Authentication failures

Failed authentication returns the standard error envelope:

{  
  "status": 401,  
  "detail": "Invalid API credentials.",  
  "code": "invalid_credentials"
}
  • A 401 or 403 means one or both headers are missing, malformed, or not authorized for the resource. Verify you are sending x-api-key and x-client-id with the values for the environment you're calling.
  • The code field (invalid_credentials) is stable and safe to branch on; the detail message is human-readable and may change.

See the full list of error codes in the Errors reference.

Keeping credentials safe

  • Never ship keys to a browser or mobile client. Call the Propelus API only from your backend; a key embedded in client-side code is exposed to anyone who loads the page.
  • Store keys in a secret manager or environment variables, not in source control.
  • Rotate a key immediately if it is exposed. Contact support@propelus.com to rotate credentials.

 

Related articles