Security

Authentication

Seller API operations require a valid ALEFBA live API key and seller-level authorization.

Authentication method

Send your API key as a Bearer token in the HTTP Authorization header.

Accept: application/json
Content-Type: application/json
Authorization: Bearer alefba_live_YOUR_API_KEY

Example request

curl --request GET \
  --url "https://alefba.eu/api/v1/ping" \
  --header "Accept: application/json" \
  --header "Authorization: Bearer alefba_live_YOUR_API_KEY"

Successful health-check response

{
  "success": true,
  "data": {
    "message": "ALEFBA API v1 is alive",
    "seller_id": 123,
    "time": "2026-07-24T15:00:00+00:00"
  }
}

Authentication errors

Status	Code	Meaning
`401`	`missing_key`	The Authorization Bearer token was not supplied.
`401`	`invalid_key`	The API key is invalid, inactive or revoked.
`429`	`rate_limited`	The API key reached its daily request limit.

Security principles

Use HTTPS for every request.
Store keys in server-side environment variables or a secrets manager.
Never expose keys in browser code, mobile application bundles or public repositories.
Revoke and replace a key immediately when compromise is suspected.

Live keys: ALEFBA keys use the alefba_live_ prefix. The complete key is a secret.