Every serious API needs to know who is calling. The most common way is an API key sent with each request. Here is how it works and how to do it safely.
What is an API key?
An API key is a long random secret that identifies your account. Whoever has the key can act as you, so treat it like a password.
Where to put the key
Always in a request header, never in the URL. URLs end up in logs, browser history and referrer headers. The SyllHost API accepts two equivalent headers:
Authorization: Bearer sh_live_xxxxxxxx X-API-Key: sh_live_xxxxxxxx
Bearer token vs X-API-Key
| Authorization: Bearer | X-API-Key | |
|---|---|---|
| Standard | Defined by an HTTP standard | Common convention |
| Library support | Built into most HTTP clients | Set as a custom header |
| Security | Same | Same |
Either works. Prefer Bearer when your HTTP library has a helper for it.
Examples
# curl
curl -H "Authorization: Bearer $SYLL_KEY" https://syllhost.com/api/v1/account
# PHP
curl_setopt($ch, CURLOPT_HTTPHEADER, ['Authorization: Bearer ' . getenv('SYLL_KEY')]);
# Python
requests.get(url, headers={"Authorization": "Bearer " + os.environ["SYLL_KEY"]})
HTTPS only
Keys sent over plain HTTP can be read by anyone on the network. Our API rejects non-HTTPS requests with 400 https_required.
How keys are stored on our side
SyllHost stores only a hash of your key, so even our staff cannot read it. That is also why the key is shown once when created; if you lose it, create a new one and revoke the old.
Authentication errors
- 401 means the key is missing, wrong or revoked.
- 403 means the key is valid but the account has no API access, or the IP is not allowed.
Next, read 12 API key security best practices.
Authentication vs authorisation
Authentication answers "who are you?" Authorisation answers "what are you allowed to do?" An API key does both in simple APIs: it identifies your account and the account's settings decide what is allowed. In the SyllHost API, for example, the account must have API access enabled, the key may be limited to certain IP addresses, and orders need enough balance. A valid key does not bypass any of these.
Testing authentication step by step
- Call
GET /accountwith your key. A 200 with your name proves authentication works. - If you get 401, check for spaces or a missing prefix in the header.
- If you get 403, the key is valid but access is not enabled or your IP is not allowed.
- If you get 400, you used http instead of https.
Common header mistakes
- Writing
Bearerwithout a space before the key. - Sending the key in a query string.
- Letting a proxy or framework strip the Authorization header; use X-API-Key in that case.
FAQ
Can I put the key in my website's JavaScript?
No. Anyone could copy it. Call the API from your server and keep the key in environment variables.
Build with our API: read the Reseller API reference and the step-by-step guide. API access is enabled per account, so contact us to request it.