Inventory API authentication

One key per tool, scoped to one workspace.

Send the key in the Authorization header. Keys are hashed at rest and shown once.

Works todayThe REST API works today on every plan, with webhooks and the MCP server.

API key authentication

Send the key as a Bearer token.

Every request carries the key over HTTPS. A request without one gets a 401.

Request with a key

curl "https://slatestock.com/api/v1/locations" \
  -H "Authorization: Bearer wsk_example_4f7c2a9d1e8b6035"

Inventory API keys

Create, name and revoke keys in settings.

Give each script or tool its own key, so you can revoke one without touching the rest.

Create keys in Settings, under API keys.
In the demo, its key is shown in Settings, under API keys, and opens only your copy of the demo.
A workspace can hold as many keys as you need, on every plan.
Each key is read only, or read and write.
The full key is shown once, when you create it.
Only a hash of the key is stored, with its last four characters for display.
Every write made with a key is recorded in the integration activity log.
A revoked key gets a 401 on its next request.

API authentication errors

A bad key gets a 401; a read-only key that writes gets a 403.

Both errors come back as JSON with a code you can test for.

401 response

HTTP/1.1 401 Unauthorized
Content-Type: application/json

{
  "error": {
    "code": "invalid_api_key",
    "message": "The API key is missing, wrong or revoked."
  }
}

403 response

HTTP/1.1 403 Forbidden
Content-Type: application/json

{
  "error": {
    "code": "read_only_key",
    "message": "This key can read but not write."
  }
}

Inventory management API pricing

The API, webhooks and the MCP server come with every plan.

Choose a plan Try the demo