Skip to content

Authentication

Every request except /health must include your API key in the x-functions-key header.

1. Get your API key

HQ issues one API key per partner for each environment (test and production). Your HQ contact sends it to you through a secure channel.

Warning

Treat the API key like a password. Never put it in source code, version control, logs, email or chat. Load it from a secret store or environment variable.

2. Call the API

Send the key in the x-functions-key header:

POST https://func-posingest-dev.azurewebsites.net/pos/v1/trade-records
Content-Type: application/json
x-functions-key: {api_key}

curl -H "x-functions-key: $API_KEY" \
  https://func-posingest-dev.azurewebsites.net/pos/v1/reference/transaction-types

A request without a valid key returns 401 Unauthorized.

3. Key rotation

  • HQ may rotate your key, for example if it may have been exposed. HQ tells you in advance and sends the new key through a secure channel.
  • If you think your key has leaked, contact HQ right away so it can be replaced.

Partner and store authorization

  • Your partner identity comes from your API key. You never send partner_id yourself.
  • You can only push or query stores registered for your account. Any other store_id returns 403 STORE_NOT_ALLOWED. To add a store, ask HQ to register it first.
  • If your partner account is not active, every request returns 403 PARTNER_INACTIVE.

Planned change

HQ plans to move to OAuth 2.0 (Microsoft Entra ID client credentials) later. You will be notified well in advance, and API keys will keep working during the transition.