Skip to main content
Developer Portal

Authentication

Secure your API requests with API keys. API keys are part of the Pro plan.

API Key Authentication

Include your API key in the Authorization header of every request:

curl https://wisepim.com/api/public/v1/me \
     -H "Authorization: Bearer $WISEPIM_API_KEY"

Keys start with wpk_. A key that is unknown, revoked or expired gets a 401. GET /me needs no permission scope: it returns the key's scopes and the project it belongs to, so it is a quick check for a new key. The same header works for the Category Finder API, which accepts any live key.

The base URL is https://wisepim.com/api/public/v1. The older direct address https://wisepim.up.railway.app/api/public/v1 still works, but wisepim.com is the supported address.

Creating API Keys

  1. 1.Open Settings > API access in WISEPIM. Keys belong to the project you have open, and only its owners and admins can manage them.
  2. 2.Click Create API key
  3. 3.Give it a descriptive name (e.g., “Production sync”)
  4. 4.Pick the permissions the integration needs. They can't be changed later
  5. 5.Copy the key immediately, because it won't be shown again

The list shows each key's first and last characters, who created it and when it was last used. Rename or revoke a key there; a revoked key fails on its next request. A project can hold 25 active keys, and each person can hold 10 of them.

Permission Scopes

project:readRead the project's identity, languages and limits
products:readList and read products, including attribute values and categories
products:writeUpdate product content: names, descriptions, identifiers and SEO fields
categories:readList the project's category tree
attributes:readList the project's attribute definitions

Security Best Practices

  • Never expose API keys in client-side code or public repositories
  • Use environment variables to store keys
  • Replace keys periodically: create a new key, switch your integration to it, then revoke the old one
  • Use the minimum required permission scopes
  • Check each key's last-used date in Settings > API access and revoke keys you no longer use

Something not documented?

Tell us what you are building and we will point you to the right endpoint, or add it.

Ask us