Authentication

All API requests are authenticated with a secret API key sent as a Bearer token.

API keys

zap_live_... — live keys for production traffic
zap_test_... — test keys for development

Keys are generated in your dashboard and displayed in full exactly once. We store only a SHA-256 hash — if you lose a key, revoke it and create a new one.

Sending the key

Include your key in the Authorization header on every request:

HTTP header

Authorization: Bearer zap_live_xxxxxxxxxxxxxxxxxxxx

Never expose a live key in client-side code, a mobile app, or a public repository. Treat it like a password. All Zapinner calls must be made from your server.

Alternate header

If Bearer auth is inconvenient, send the key in the X-Zapinner-Key header instead. For backwards compatibility the legacy X-Zapiit-Key header is still accepted, so existing integrations keep working without changes.

Authentication errors

Missing, malformed, or revoked keys return 401 with a sanitized error body:

401 Unauthorized

{
  "error": {
    "code": "invalid_api_key",
    "message": "Invalid API key.",
    "request_id": "req_9f8e7d"
  }
}