Authentication

Every Partner API call except the OpenAPI document requires a company secret key. HTTPS is required in production.

Bearer token

Send the secret in the Authorization header. You may also send X-Api-Key with the same value. Prefer Authorization.

Header

Authorization: Bearer sk_live_abc…

How keys work

Created by a company owner or admin in Developers.
Hashed at rest with a prefix so lookups stay constant-time.
Last-used timestamp updates when a request authenticates.
Optional IP allowlist: if set, any other client IP returns 403 PARTNER_IP_FORBIDDEN.
Empty scopes mean full access. Non-empty scopes are an allow-list.
Safra admin can disable Partner API for a company (PARTNER_API_DISABLED) or revoke every key.

HTTPS

In production, non-HTTPS requests fail with 400 PARTNER_HTTPS_REQUIRED. Local and test environments may allow HTTP.

Request ids

Send X-Request-Id if you want to correlate logs with your CRM. If you omit it, Safra generates a UUID and returns it on the response as X-Request-Id. Request logs are kept 14 days.