Authentication Endpoints

This document covers how an approved partner account authenticates to the All About Pawz API: the API key, how it is presented on every request, how keys are issued, rotated, and revoked, and the errors returned when authentication fails. It assumes the conventions in Overview.

Access

API access is issued by the Company and is limited by seller type: manufacturer and supplier accounts receive API access for importing data; other account types use the Seller Center and file imports. The governing instrument is the Developer Agreement; the API Access Tiers govern use. Access is granted per account, is not transferable, and may be suspended or revoked under the Developer Agreement. There is no self-service sign-up: if your account has been approved for API access, your credentials are issued to you by the Company.

Presenting your key

Every request to the base URL https://www.aapawz.com/api carries your key as a bearer token

Authorization: Bearer <your-api-key>

There are no session endpoints, no login call, and no token exchange: the key itself is the credential, and it is sent unchanged on every request. Requests are accepted over HTTPS only.

Example

GET /catalog/products HTTP/1.1
Host: www.aapawz.com
Authorization: Bearer <your-api-key>
Accept: application/json

What a key identifies

A key identifies exactly one account. Everything the key can read or change is scoped to that account and to the permissions of its access tier: a key cannot read another account's products, orders, or payments, and an identifier belonging to another account returns 404 rather than the other account's data. A key cannot be shared between accounts, embedded in a product you distribute, or used on behalf of a third party.

Verifying a key

Use the account endpoint to confirm a key works and to learn which account and tier it belongs to

Method	Path	Purpose
GET	`/account`	Return the account the key belongs to, its type, and its access tier

Response 200

{
  "id": "acct_7k2m9x",
  "name": "Acme Pet Supply Co.",
  "account_type": "supplier",
  "api_tier": "import",
  "status": "active"
}

Call this endpoint once when you first configure an integration, and after every key rotation, before sending production traffic.

Key lifecycle

Issuance. Keys are issued by the Company when API access is approved, and delivered to the account's registered technical contact. The full key is shown once, at issuance. Store it immediately in a secrets manager; the Company cannot display it again, and a lost key is replaced, not recovered.
Rotation. An account may hold two active keys at once so you can rotate without downtime: issue the new key, update your systems, verify with GET /account, then ask the Company to revoke the old key. Routine rotation is governed by the API Key Management and Rotation Policy.
Revocation. The Company revokes a key on your request, on suspected compromise, or when access ends under the Developer Agreement. A revoked key fails immediately with 401. If you suspect a key has leaked, contact support@aapawz.com at once and request revocation and reissue.
Expiry. Keys do not expire on a fixed schedule, but the Company may require rotation with reasonable notice, announced to the technical contact of record.

Handling the key

Store the key in a secrets manager or environment configuration outside source control. Never commit it to a code host, include it in a client application, a mobile app, or browser code, or send it in a URL query string.
Send it only in the Authorization header, only to https://www.aapawz.com.
Restrict which of your systems and staff can read the key. Log request metadata, never the key itself; redact the header in any log or trace you keep or share.

Authentication and authorization errors

Status	Code	Meaning	What to do
401	`missing_key`	No `Authorization` header was sent	Add the header and retry
401	`invalid_key`	The key is unknown, revoked, or malformed	Check the stored value; request reissue if it was revoked
403	`tier_forbidden`	The key is valid but its tier does not permit this endpoint or action	Use an endpoint within your tier, or request a tier change from the Company
403	`account_suspended`	The account's API access is suspended	Contact support@aapawz.com

Error bodies follow the standard form specified in Error Codes

{
  "error": {
    "code": "invalid_key",
    "message": "The API key provided is not valid."
  }
}

Do not retry a 401 or 403 in a loop: authentication failures do not resolve by repetition, and repeated failures may be treated as misuse under the Developer Agreement.

Overview

Catalog Endpoints