Back to Developer

Authentication

API key management, scopes, and security best practices.

API Key Format

Every request must include the x-api-key header.

curl https://whale-gateway.fly.dev/v1/stores/{storeId}/products \
  -H "x-api-key: wk_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
wk_live_...

Production keys. Access real store data.

wk_test_...

Sandbox keys. Isolated test environment.

Store Scoping

Each API key is bound to a single store. The {storeId} in the URL must match the store your key belongs to. Mismatches return a store_mismatch_error (403).

Scopes

API keys have scopes that control which resources they can access. Use the principle of least privilege — only grant the scopes your integration needs.

ScopeAccess
*Full access (all read + write)
read:*All read scopes
write:*All write scopes
read:products / write:productsProduct catalog
read:orders / write:ordersOrder management
read:customers / write:customersCustomer profiles
read:inventory / write:inventoryStock levels
read:locationsStore locations
read:analyticsSales, traffic, and product analytics
read:storefront / write:storefrontVisitor sessions and events
read:agents / write:agentsAI agent configuration
write:agentAI agent chat
read:cart / write:cartShopping carts
read:checkout / write:checkoutCheckout and payment intents
read:documents / write:documentsDocument management
read:telemetry / write:telemetryError tracking and analytics events
read:portal / write:portalCustomer portal

Auth Errors

401authentication_error

Missing, invalid, or revoked API key.

403permission_error

API key lacks the required scope for this endpoint.

403store_mismatch_error

The storeId in the URL does not match the API key's store.

Security Best Practices

  • Never expose API keys in client-side code, Git repos, or public URLs.
  • Use environment variables (WHALETOOLS_API_KEY) to store keys.
  • Create separate keys for each integration with minimal scopes.
  • Rotate keys periodically and revoke unused ones immediately.
  • Use wk_test_ keys during development — they cannot access production data.