Partner API authentication

The Partner API takes either credential on every request. Both identify the same partner, and both decide the environment: a sandbox key can only ever reach the sandbox.

Bearer token, the preferred path

Exchange your key for an access token and send that. A leaked request log then exposes an hour rather than a permanent credential.

curl -X POST "https://sandbox.capvant.com/partner/v1/oauth/token" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "grant_type=client_credentials" \
  -d "client_id=cv_pk_test_ab" \
  -d "client_secret=YOUR_PARTNER_API_KEY"

client_id is the key prefix shown in your portal; client_secret is the key itself. The response carries a token valid for one hour:

{
  "access_token": "eyJhbGciOi...",
  "token_type": "Bearer",
  "expires_in": 3600
}

Send it as a bearer token:

curl "https://sandbox.capvant.com/partner/v1/me" \
  -H "Authorization: Bearer eyJhbGciOi..."

Cache the token until it expires rather than minting one per request, and refresh it a minute early so a request in flight never lands on an expired token.

API key, supported alongside it

The raw key also works in the X-API-Key header, which is the quickest way to make a first call:

curl "https://sandbox.capvant.com/partner/v1/me" \
  -H "X-API-Key: cv_pk_test_..."

Live keys start with cv_pk_, sandbox keys with cv_pk_test_. Store either server side only, one key per integration so each can be revoked on its own.

Confirming who you are

GET /me returns the partner the credential belongs to and the environment it is bound to. Call it first: it is the fastest way to prove a key is live and pointed where you think it is.