Authentication

All Poomi API requests require authentication via an API key passed in the Authorization header.

Authentication Method

Include your API key in the Authorization header using the Bearer scheme:

curl https://www.poomi.pet/api/v1/{endpoint} \
  -H "Authorization: Bearer pk_your_api_key_here"

pk_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

Keys use the pk_ prefix followed by a 32-character NanoID.

HTTP Status	Error Code	Description
401	`UNAUTHORIZED`	Missing or invalid Authorization header
401	`INVALID_KEY`	The API key does not exist
403	`KEY_DISABLED`	The API key has been disabled
403	`KEY_REVOKED`	The API key has been revoked
403	`KEY_EXPIRED`	The API key has expired

{
  "success": false,
  "error": {
    "code": "INVALID_KEY",
    "message": "Invalid API key"
  }
}

Use environment variables — Never hardcode API keys in source code
Server-side only — Make API calls from your backend, never expose keys in client-side code
Separate environments — Use different keys for development and production
Revoke compromised keys — If a key is exposed, revoke it immediately in the Developer Console