icon
StandMap API

Authentication

Partner requests are authenticated with an API key: a client id that identifies your account, and a secret that proves it's you. You manage both through the reseller panel.

Getting a key

Your client id is assigned when your reseller account is created — it does not change when keys are issued or revoked. To get a secret, open the reseller panel, go to API keys, and create one. The dialog shows your client id alongside the new secret.

clientId Starts with rsc_. Your account's stable machine identity — exists from account creation, independent of key history. Safe to log.
secret Starts with rss_. We store only a hash — if you lose it, revoke the key and issue a new one.
The secret is shown exactly once. Copy it into your secret store the moment it appears. If you close the dialog without saving it, revoke the key and create another.

Sending credentials

Two forms are accepted; they are equivalent, so use whichever your HTTP client makes easier. Dedicated headers are checked first:

Dedicated headers 
X-Client-Id: rsc_AbCdEfGhIjKlMnOpQrStUv
X-Client-Secret: rss_1a2b3c4d5e6f7a8b9c0d1e2f_XyZ...

Or HTTP Basic, with the client id as the username and the secret as the password:

HTTP Basic 
Authorization: Basic base64(clientId + ":" + secret)

When authentication fails

Any rejected credential returns 401 with an empty body — no JSON, nothing to parse. The response is deliberately identical whether the client id is unknown, the secret is wrong, the key was revoked, or your account is suspended, so nobody can probe for valid ids.

If you get a 401 you did not expect, check in the panel whether the key is still active and whether your account is in good standing — the API will not tell you which it was.

Rotating a secret

Several keys can be active at once under the same client id, so you can roll a secret without downtime. Revocation takes effect on the very next request.

Zero-downtime rotation 
// 1. Create the new key, old one keeps working
POST /v1/billing/resellers/me/api-keys

// 2. Deploy the new secret to your integration

// 3. Confirm nothing still uses the old key, then revoke it
DELETE /v1/billing/resellers/me/api-keys/{apiKeyId}

The panel shows a last used timestamp per key — check it before revoking, to be sure nothing is still authenticating with the old secret. You can hold up to five active keys at a time; at the cap, creating another fails rather than silently displacing one.

Scope of a key

A key carries exactly the rights your reseller account already has — no more, and there are no per-key permissions to configure. It can check your balance, issue licenses and generate promo codes. It cannot manage other keys, change your account, or see anything belonging to another partner.

Which account is being charged comes from the credentials themselves, never from the request body, so there is nothing you can send that would spend someone else's quota.