Authentication

Authenticate Swipelux API requests with the X-API-Key header from a protected backend, use separate sandbox and live keys, and keep keys out of client code.

Keep every Swipelux API key on a protected backend. Never place a key in browser code, a mobile application bundle, or a client-visible configuration file.

Send your API key

Use the shared base URL https://platform.swipelux.com and send your key in the X-API-Key header.

export API_BASE='https://platform.swipelux.com'
export SWIPELUX_API_KEY='replace-with-your-api-key'

curl --request GET \
  "${API_BASE}/v3/capabilities" \
  --header "X-API-Key: ${SWIPELUX_API_KEY}"

GET /v3/capabilities confirms that the key is valid and your backend can reach the API.

Sandbox and production

Sandbox and production use the same API host. The API key selects the environment.

Keep the environment choice in deployment configuration. A production deployment must never fall back to a sandbox key, and a sandbox deployment must never receive production credentials.

Store credentials safely

Store sandbox and production keys in separate secret-manager entries. Grant each backend deployment access only to the entry it needs.

Keep keys out of source control, logs, analytics, support screenshots, and error responses. Rotate a key if you believe it has been exposed.

If a request returns unauthorized or forbidden, use Errors and retries to distinguish invalid credentials from missing permissions.

Next, configure sandbox testing or start the Quickstart.