Authenticate requests

Send your API key in the X-API-Key HTTP header on every request.

Never put your key in a URL

Passing the key as a query parameter leaves it in browser history, server access logs, and referrer headers. Always send it in the header.

HTTP request example

POST /partner/v1/ddex/ingests HTTP/1.1
Host: api.kitbetter.com
X-API-Key: YOUR_API_KEY
Content-Type: application/json
Accept: application/json

The equivalent cURL request:

curl -X POST "https://api.kitbetter.com/partner/v1/ddex/ingests" \
  -H "X-API-Key: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"releaseId": "DIST-2026-00123", "xmlUrl": "https://your-bucket.s3.amazonaws.com/ern/abc.xml?X-Amz-Expires=3600"}'

Authentication error responses

Status code	Cause	What to do
401 Unauthorized	Missing, invalid, or revoked key	Check the header name (X-API-Key) and the key value; reissue the key if needed
403 Forbidden	Valid key without sufficient permission (including inactive partners, PROVIDER_INACTIVE)	Verify your partner's permission scope, or contact us

For the error response body format, see Error codes.