> ## Documentation Index
> Fetch the complete documentation index at: https://imprint-b3c5d5af-partner-docs-latest.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Finding and using your API keys

The Imprint API uses API Keys to authenticate requests, and these are different for each environment. You can view and manage your API keys in the **Imprint Dashboard.**

API authentication is performed via **HTTP Basic Auth**. Provide your API key as the basic auth username value. You do not need to provide a password.

If you need to authenticate via bearer auth (e.g., for a cross-origin request), use `-H "Authorization: Bearer 4eC39HqLyjWDarjtT1zdp7dc"` instead of `-u 4eC39HqLyjWDarjtT1zdp7dc`.

```bash theme={null}
curl https://dev.sbx.imprint.co/v2/customers \
  -u YOUR_API_KEY:
```

### Scopes

Each API key carries a set of **scopes** that determine which endpoints it may call. Scopes are configured by your Imprint team based on your integration — see [API key rotation](/api-key-rotation) for how initial keys are provisioned.

The scope required by an individual endpoint is documented on that endpoint's page under the **REST API** tab. Endpoints not listed below need no scope beyond a valid API key.

| Scope | Grants access to |
| - | - |
| `ORDER_READ` | `GET /v2/orders`, `GET /v2/order_events` |
| `ORDER_WRITE` | `POST /v2/orders`, `PUT /v2/orders/{order_id}`, `DELETE /v2/orders/{order_id}`, `POST /v2/order_events`, `DELETE /v2/order_events/{order_event_id}` |
| `TRANSACTION_INTENT_READ` | `GET /v2/transaction_intents/{intent_id}`, `GET /v2/customers/{customer_id}/transaction_intents` |
| `TRANSACTION_INTENT_WRITE` | `POST /v2/transaction_intents`, `POST /v2/transaction_intents/{intent_id}` |
| `CARD_WRITE` | `POST /v2/payment_methods/{payment_method_id}/provision/{wallet}` |
| `ACCOUNT_READ` | `GET /v2/customers/{customer_id}/accounts`, `GET /v2/customers/{customer_id}/accounts/{account_id}`, `GET /v2/customers/{customer_id}/accounts/{account_id}/rewards_categories`, `GET /v2/customers/{customer_id}/accounts/{account_id}/statements` |
| `PCI_DETAILS_READ` | Unmasked card details (`card.pci_details`) on payment method responses |
| `AUTHORIZED_USER_READ` | Authorized user details (`authorized_users`) on `GET /v2/customers/{customer_id}` |

Calling an endpoint with a key that lacks the required scope returns `403 Forbidden`:

```json theme={null}
{
  "error": {
    "type": "FORBIDDEN_ERROR",
    "message": "forbidden"
  }
}
```

`PCI_DETAILS_READ` and `AUTHORIZED_USER_READ` are the exceptions — they never fail a request. Payment method endpoints succeed without `PCI_DETAILS_READ`, but omit `card.pci_details` (PAN, CVV, expiry) from the response. Retrieve Customer succeeds without `AUTHORIZED_USER_READ`, but omits `authorized_users`.

<Note>
  A new API key created via `POST /v2/keys` inherits exactly the scopes of the
  key used to create it. A key with no scopes creates another key with no scopes;
  rotation never adds newly enabled product scopes automatically.
</Note>

### Multi-Product Support

If your partnership spans multiple products (e.g., a parent company with several co-branded products), include the `x-imprint-merchant-key` header in your requests to specify which product the request applies to.

| Header | Required | Description |
| - | - | - |
| `x-imprint-merchant-key` | No | Identifies the target product. Provided by your Imprint team during onboarding. |

If you have multiple products, you must supply the merchant key in the header in order to retrieve information for that merchant/product:

```bash theme={null}
curl https://dev.sbx.imprint.co/v2/customers \
  -u YOUR_API_KEY: \
  -H "x-imprint-merchant-key: your-merchant-key"
```


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.