Everything you need to know about API keys, permissions, and security
The Connect2Print API uses API keys for authentication. Each request must include a valid API key in the Authorization header.
Key points:
API keys have different prefixes based on their environment:
Used for development and testing. Start with:
Test mode keys only work in the test environment and don't have access to live data.
Used for production. Start with:
Live keys have access to real data and should be protected carefully.
You can create and manage API keys from the admin panel:
Important: Your API key is shown only once when you create it. Store it securely immediately.
Include your API key in the Authorization header as a Bearer token:
Authorization: Bearer YOUR_API_KEY
// cURL curl -H "Authorization: Bearer c2p_test_..." \ https://app1.connect2print.com/api/v1/orders // PHP $headers = ['Authorization: Bearer c2p_test_...']; // JavaScript headers: { 'Authorization': 'Bearer c2p_test_...' }
Scopes define what an API key is allowed to do. Each scope grants access to specific endpoints.
Scopes are split into read and write permissions:
:read scopes allow viewing data (GET endpoints):write scopes allow creating/updating/deleting data (POST/PATCH/DELETE endpoints)orders:read, orders:writecustomers:read, customers:writeproducts:readaddresses:read, addresses:writecart:read, cart:writefiles:read, files:writeshipments:read, shipments:writeproduction:read, production:writeinvoices:read, invoices:writequotes:read, quotes:writewebhooks:read, webhooks:writestock:read, stock:writePrinciple of Least Privilege: Only grant the permissions necessary for your integration.
The API supports two separate environments:
Safe environment for development and testing:
c2p_test_*)Production environment with real data:
c2p_live_*)Follow these best practices to keep your API keys secure:
Never commit API keys to source code or version control. Use environment variables or secure secret management systems.
Always send API requests over HTTPS to protect your keys in transit.
Update your API keys periodically, especially if you suspect compromise.
Only assign the scopes needed for your integration. Avoid granting unnecessary access.
Consider setting expiration dates on API keys to enforce rotation.
In production, whitelist specific IP addresses that can use the key.
Regularly check API logs for unusual activity.
If a key is compromised, revoke it immediately from the admin panel.
Common authentication errors and solutions:
Your API key is invalid or missing. Check that:
Your API key lacks the required permissions (scopes). Solution:
You've exceeded the rate limit. See our Rate Limiting Guide for details.
Ensure you're using the right type of key for your environment. Test keys don't work in live mode and vice versa.
Now that you understand authentication, explore related topics: