Overview
Vendor API keys let you authenticate with the PuppetVendors API programmatically. Each key is scoped to a single vendor account and can be restricted to specific permissions.
Key Prefixes
Available Scopes
Every API key must have at least one scope. Each scope grants access to a specific set of endpoints.
Unscoped Endpoints
These endpoints work with any valid vendor token — no specific scope required on your API key:
How Scopes Work
When you create an API key, you choose which scopes to include. The API rejects requests that require a scope your key doesn’t have with 403 Forbidden.
Read vs Write
:read scopes grant access to GET endpoints — listing, viewing, and exporting data:write scopes grant access to POST, PUT, PATCH, and DELETE endpoints — creating, updating, and deleting data
Write scopes do not automatically include read access. If you need both, add both scopes (e.g., products:read and products:write).
Managing API Keys
When you create or rotate a key, the plaintext token is returned exactly once. Store it securely — you cannot retrieve it later.
Quick Start Example
