API keys
Create, scope and revoke the credentials your systems use to talk to the Pricing API.
Every API request authenticates with a key and a signing secret. Manage them under API Keys in the app.
Creating a key
Open API Keys.
Choose to generate a new key.
Give it a name describing what will use it —
ERP nightly sync,PIM staging. You will thank yourself when there are five.Optionally add allowed IPs, comma-separated.
Generate.
You get two values:
API key
dlb_
X-API-Key
Signing secret
sec_
X-Signing-Secret
Both are required on every request.
Credentials are shown once, at creation. Copy them into your secret store immediately. If you lose them, revoke the key and create another — they cannot be retrieved.
Restricting by IP
Allowed IPs limits a key to requests originating from addresses you list. If your ERP has a static outbound IP, set it — a leaked key is then useless from anywhere else.
Leave it empty to accept requests from any address.
Only set this if your outbound IP is genuinely static. Cloud workers, serverless functions and most CI runners rotate addresses, and requests will start failing without an obvious cause.
Revoking
Revoke a key to stop it working immediately. Revoked keys disappear from the active list; you can still view them separately for audit.
Revoke when:
a credential may have leaked
someone with access to it leaves
an integration is retired
Revocation takes effect at once, so make sure nothing in production is still using the key.
Good practice
One key per integration. Retiring one system then never disturbs another.
Never commit credentials. Environment variables or a secret manager.
Separate staging from production. Different keys, clearly named.
Rotate on a schedule. Create the replacement, deploy it, then revoke the old one — in that order, so there is no gap.
Using them
Full reference: Pricing API.
Common problems
401 or 403. A wrong or revoked credential, or only one of the two headers is being sent. Both are required.
Works locally, fails in production. Almost always an IP allowlist that does not include your production egress address.
Last updated