Bearer token
Send your API key in the Authorization header:
Keys are scoped to a single tenant. Each key only returns inventory for the brand it was issued to.
Security requirements
Store API keys on your servers only. Never ship keys to browsers, mobile apps, or public repositories.
- Rotate keys immediately if you suspect exposure.
- Use HTTPS for all requests (the production endpoint enforces TLS).
- Every action, including
health, requires a valid API key.
Requesting a key
Contact your Keystone account representative or email support@keystoneb2b.io. Include your company name and the integration environment (production or staging).