Authentication
The APIs in this documentation use either an x-api-key header or an
Authorization: Bearer header. Check each endpoint page before implementing.
Header Types
| Authentication type | Header | Used by |
|---|---|---|
| API key | x-api-key: YOUR_API_KEY | Customer, Item, Inventory, Order, Shipment, Outstanding Shipment |
| Bearer token | Authorization: Bearer YOUR_TOKEN | Outbound Order GraphQL, Update Order Status, Tally WhatsApp Send |
warning
Do not paste real production keys into docs, tickets, screenshots, or sample
payload files. Use placeholders such as YOUR_API_KEY and YOUR_TOKEN.
x-api-key Example
Headers
Content-Type: application/json
x-api-key: YOUR_API_KEY
Bearer Token Example
Headers
Content-Type: application/json
Authorization: Bearer YOUR_TOKEN
Endpoint Authentication Matrix
| Endpoint | Method | Auth |
|---|---|---|
/v2/retailers/sync-data | POST | x-api-key |
/v2/items/sync-data | PUT | x-api-key |
/v2/godowns/thirdparty-stock-sync | POST | x-api-key |
/v2/orders/process-thirdparty-orders | POST | x-api-key |
/v2/shipments/third-party | POST | x-api-key |
/v2/shipments/outstanding/sync-data | PUT | x-api-key |
/v2/graphql | POST | Bearer token |
/v2/tally/orders/update-status | POST | Bearer token |
/v2/tally/send-whatsapp | POST | Bearer token |
Implementation Checklist
- Confirm which auth style the endpoint requires.
- Store secrets outside source control.
- Use environment variables in scripts and Postman environments.
- Rotate a key immediately if it is exposed.
- Keep public documentation examples placeholder-only.