Authentication
Secure your API access with a simple, key-based authentication flow.
Why API keys?
- Simple, stateless authentication
- Per-user keys with configurable permissions
- Compatible with server-to-server and backend integrations
- Simple, stateless authentication
- Issued per customer portal user with configurable permissions
- Compatible with server-to-server and backend integrations
Step 1: Get Your API Key
Your API key identifies your application and provides access to the Food Trace API.
API keys are managed in your customer portal. If you need help, please contact support.Step 2: Make an Authenticated Request
Send your API key on the X-API-Key header with every request — this is the only credential the API needs. There's no separate token to fetch first and nothing else to send:
curl https://developer.traceallglobal.com/api/v1/suppliers/123 \
-H "X-API-Key: your_api_key_here"Response:
{
"success": true,
"data": { ... }
}Behind the scenes the API also maintains a short-lived session token per user for internal auditing, but it's never returned in the response and there's nothing you need to store, refresh, or send on an Authorization header. Your API key alone authenticates every request.
Permission Levels
Each API key carries a permission level that determines which HTTP methods it can use. If your key's level is too low for an operation, the API responds with 403.
| Level | Name | Allowed methods |
|---|---|---|
| 1 | Basic | GET |
| 2 | Editor | GET, POST, PUT, PATCH |
| 3 | Manager | GET, POST, PUT, PATCH, DELETE |
| 4 | Admin | All methods |
Security Best Practices
- ✅ Store API keys securely (environment variables)
- ✅ Use HTTPS for all requests
- ✅ Check the permission level your key needs for each HTTP method
- ✅ Handle 401/403/404 error responses gracefully
- ✅ Rotate/revoke keys immediately if compromised
- ❌ Expose API keys in client-side code
- ❌ Use HTTP for authentication
- ❌ Commit API keys to source control
- ❌ Share API keys between environments