Skip to content
ConnectPlane Developers

Authentication

ConnectPlane public API operations require an API key in the X-API-Key request header. An account administrator creates, scopes, rotates, and revokes keys from the authenticated Portal.

Authenticated API request
curl https://api.connectplane.com/api/v1/commerce/orders \
  -H "X-API-Key: ${CONNECTPLANE_API_KEY}"

Keep credentials out of browsers

Section titled “Keep credentials out of browsers”

Call the API from a server-side application or secret-aware automation environment. Store keys in a runtime secret store. Never put a key in source control, a URL, browser JavaScript, logs, chat, or an AI-agent prompt.

  • 401 means the key is missing, invalid, expired, or revoked.
  • 403 means the key is valid but lacks the required permission.

The Markdown version of this guide remains available for tools and compatibility consumers.