Authentication

With the verify API, your own systems read and write the values your tags carry. Every request sends an API key, and the key belongs to your team.

Creating a key

Open API Keys on the dashboard and press Create API Key. Name the key after the system that will hold it, “Warehouse sync” or “ERP”, so you know which one to revoke later.

The key appears once, right after you create it. Copy it into your secret store then. TAGBASE keeps only a hash and cannot show the key again. If you lose it, create a new one.

A key has the rights of the whole team. A request with the key can read and change every tag on every product the team owns, the same as a member on the dashboard.

Revoking a key

Press Revoke next to a key in the list. The key stops working at once, and a request that still uses it gets a 401. A team can hold more than one key, so you can rotate while your integration keeps running: create the new key, move your integration over, then revoke the old one.

Sending the key

A key is two parts, a key_ id and a secret, joined by a colon. Send the whole string as a bearer token in the Authorization header:

Authorization: Bearer key_4vVevWu1Ettnd3dqiWUxY:eruD6LXiYaQd3WlwcJ-ZE1lSUiaclHUfeoyiH_J9tko

curl https://verify.tagbase.io/api/tags \
  -H "Authorization: Bearer $TAGBASE_API_KEY" \
  -H "Accept: application/vnd.api+json"

const res = await fetch("https://verify.tagbase.io/api/tags", {
  headers: {
    "Authorization": `Bearer ${process.env.TAGBASE_API_KEY}`,
    "Accept": "application/vnd.api+json",
  },
});
const { data, meta } = await res.json();

$response = $client->get("https://verify.tagbase.io/api/tags", [
    "headers" => [
        "Authorization" => "Bearer " . getenv("TAGBASE_API_KEY"),
        "Accept"        => "application/vnd.api+json",
    ],
]);
$page = json_decode((string) $response->getBody(), true);

page =
  Req.get!("https://verify.tagbase.io/api/tags",
    headers: [
      {"authorization", "Bearer #{System.fetch_env!("TAGBASE_API_KEY")}"},
      {"accept", "application/vnd.api+json"}
    ]
  ).body

The API is server to server. Call it from your backend, never from a page in a browser, where the key would be visible to anyone who opens the source.

Auth errors

The API answers 401 to a request with no key, a malformed header, a wrong secret, or a revoked key:

{ "errors": [{ "status": "401", "title": "Unauthorized" }] }

The API does not say which of those it was. Check that the header reads Bearer followed by the whole key, key_…:…, and that the key is still listed under API Keys.

Next: read and write your tags with the Tags endpoints. The API page covers the base URL, errors, rate limits, and pagination that every endpoint shares. The Products and Verifications endpoints cover the rest of the API.