Is this Sumtracker API request correct?

Question

I wish to use the Sumtracker API, and I want to connect and do a basic get for this endpoint.

Let's say that my API key is 1234567890abc. The code is here:

import requests

url = "https://inventory-api.sumtracker.com/api/version/2025-03/products/"

headers = {
    "accept": "application/json",
    "Authorization": "1234567890abc"
}

response = requests.get(url, headers=headers)

The response gives a 403 and the text is:

{"type":"client_error","errors":[{"code":"permission_denied","detail":"You do not have permission to perform this action.","attr":null}]}

This suggests to me that the API key is not working correctly. This is the exact example that they give on their website so I have to presume it is correct.

That said, on their authentication section, it says this:

Authorization: Api-Key <api-key-value>

Lets say the API key is dv7dm.asm1hga2seks4uybay22hyuar

Then, the value of the header will be Api-Key dv7dm.asm1hga2seks4uybay22hyuar

Does this mean that the API key should also include that text? I have tried using this line:

"Authorization": "Api-Key 1234567890abc"

but it didn't seem to make a difference. Is it typical that the authorization will contain more than just the key itself?

Authorization headers should have a scheme (in this case Api-Key) in the value, yes. If it still doesn't work when you set it correctly, as in your second example, you'll have to contact the providers of the API - there's nothing we can do about that. — jonrsharpe
– jonrsharpe, Commented Aug 2 at 15:36
some APIs need Authorization with word Bearer, other with Basic or with Api-Key, and other with something else. Maybe they expect to use different methods for authorization and they need this word to recognize what method you used. — furas
– furas, Commented Aug 2 at 18:56

Akon_Namikaze · Accepted Answer · 2025-08-02 15:47:59Z

-1

As mentioned in the authentication section of the sum tracker,it is necessary to send the authentication header in the specified format.

Authorization: Api-Key <api-key-value>

As for your question,why the Authorisation header requires the prefix API-Key,it is due to the HTTP Auth headers scheme which is defined in Mozilla web docs.You can check more about it in the MDN web docs

answered Aug 2 at 15:47

Akon_Namikaze

491 silver badge4 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

Is this Sumtracker API request correct?

1 Answer 1

Comments

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Related