Authentication
Every request carries your API key as a bearer token.
Authorization: Bearer stilo_sk_...Getting a key
Any active stilo Creator can create keys in Configuración › API. Creating your first key means accepting the API terms of use. You can hold up to 10 active keys, for example one per project, so you can revoke one without breaking the others.
- Keys never expire unless you choose 90 or 365 days when you create them.
- You see a key once. stilo only stores a fingerprint, so a lost key can't be recovered: create a new one.
- Revoking a key stops it immediately.
Scopes
Give each key only what it needs.
| Scope | Allows |
|---|---|
catalog:read | Brands, products and URL lookups. |
links:read | Listing and reading your links. |
links:write | Creating and deactivating links. |
reports:read | Your clicks, sales, commissions and payouts (coming soon). |
A key without the scope an endpoint needs gets 403 insufficient_scope.
Keeping keys safe
- Use the key only from a server or script. The API sends no CORS headers, so browsers can't call it directly, and a key in a web page is visible to anyone.
- Store it in an environment variable or a secrets manager, never in your code or a repository.
- If a key is pushed to a public GitHub repository, we revoke it automatically.
A key can only read your own data and create links to stilo stores. It can't sign in to your account, change your settings or reach your payouts.
Authentication errors
| Status | type | Meaning |
|---|---|---|
| 401 | authentication_required | No Authorization header. |
| 401 | invalid_api_key | Malformed, revoked or expired key. |
| 403 | access_revoked | API access for your account is blocked. Write to contacto@stilo.io. |
| 403 | account_not_eligible | Your stilo account is not an active Creator account. |
| 403 | insufficient_scope | The key lacks the scope this endpoint needs. |