Skip to main content

Authentication

The Simplr API uses API keys for product integrations and bearer tokens for portal management endpoints.

API Keys​

Include your API key in the X-API-Key header:

curl https://api.simplr-ai.com/v1/check \
  -H "Content-Type: application/json" \
  -H "X-API-Key: sk_live_xxxxxxxxxxxxx" \
  -d '{"email": "user@example.com"}'

Key Types​

TypePrefixUsage
Live Secretsk_live_Server-side production calls; consumes credits
Test Secretsk_test_Server-side testing; usage is recorded but does not consume credits
Live Publicpk_live_Client SDK calls in production
Test Publicpk_test_Client SDK testing

Getting Your Keys​

  1. Log in to simplr-ai.com
  2. Go to API Keys
  3. Click Create API Key
  4. Copy your key (only shown once)

Security Best Practices​

Keep Keys Secret
  • Never expose sk_* secret keys or portal bearer tokens in client-side code
  • Never commit credentials to version control
  • Store server credentials in environment variables or a secret manager
  • Use only pk_* public keys in browser/mobile SDKs

Portal bearer tokens​

Organization, billing, webhook, operations, and other dashboard-management endpoints use Authorization: Bearer <access-token>. Obtain the access/refresh token pair through the portal authentication flow. Do not substitute an API key for a bearer token unless the endpoint explicitly documents client authentication.

# .env
SIMPLR_API_KEY=sk_live_xxxxxxxxxxxxx
// server.js
const apiKey = process.env.SIMPLR_API_KEY;

Key rotation​

Rolling a secret key revokes the old key immediately and returns a replacement once. If a key is compromised:

  1. Go to API Keys in your dashboard
  2. Click the compromised key
  3. Roll it to create a replacement, or revoke it without replacement
  4. Update your application with the replacement before rolling whenever possible; there is no overlap window

Error Responses​

Missing API Key​

{
  "success": false,
  "message": "Missing X-API-Key header"
}

Invalid API Key​

{
  "success": false,
  "message": "Invalid API key"
}

Revoked API Key​

{
  "success": false,
  "message": "Invalid API key"
}