Skip to main content
An API key is required on every request so we know the request comes from your business.

​
Create a key

1

Open API keys

In the Bridge app, go to API keys and choose Generate API Key.
2

Name it

Give it a name that says where it’s used, for example Production API.
3

Choose how long it lasts

Pick 1, 7, 30, 90, 180, or 365 days. The key stops working after that.
4

Choose what it can do

Pick its scopes (see below). Only give a key what it needs.
5

Copy and save the key

Your new key is shown only once, right after you create it. Copy it straight away and save it somewhere safe, such as your server’s secret manager. Once you leave this screen, the full key can’t be shown again. If you lose it, revoke it and create a new one. 

​
Sandbox and live keys

Create sandbox keys in the sandbox Bridge app and live keys in the live Bridge app.

​
Scopes: what a key can do

Each scope can allow read (look things up) and write (create or change things). If a key calls an endpoint it isn’t allowed to use, the request fails with 403 and the message This API key does not have access to this resource.

​
Use the key

Send the key in the X-BRIDGE-API-Key header of every request:
Never put your API key in a mobile app, a website, or a public code repository. Only call Bridge from your own server.

​
Update or revoke a key

Open the key in API keys to see when it was last used, change its scopes, or revoke it. A revoked key stops working straight away. If you think a key has leaked, revoke it and create a new one.

​
Key errors

These all return 401: An expired or revoked key is also rejected with 401.
Last modified on October 29, 2026