Authentication

The Infinite API uses API keys for authentication. All requests must include a valid API key in the Authorization header.

API Keys

API keys are unique identifiers that authenticate your requests to the Infinite API. Each key is tied to your organization and determines what resources you can access.

Key Format

API keys follow this format:

Live keys: sk_live_... - For production use
Sandbox keys: sk_sandbox_... - For development and testing

Never expose your API keys in client-side code, version control, or logs. Always keep them secure on your backend servers.

Making Authenticated Requests

Include your API key in the Authorization header using the Bearer scheme:

import requests

headers = {
    'Authorization': 'Bearer sk_live_your_api_key_here',
    'Content-Type': 'application/json'
}

response = requests.get('https://api.infinite.dev/v1/customers', headers=headers)

const headers = {
  Authorization: 'Bearer sk_live_your_api_key_here',
  'Content-Type': 'application/json',
};

const response = await fetch('https://api.infinite.dev/v1/customers', {
  headers,
});

export INFINITE_API_KEY=sk_live_your_api_key_here
infinite customers list --limit 10

List my customers.

curl -X GET "https://api.infinite.dev/v1/customers" \
  -H "Authorization: Bearer sk_live_your_api_key_here"

Error Responses

Authentication failures return specific error codes:

Invalid API Key

{
  "error": "Unauthorized",
  "message": "Invalid API key",
  "statusCode": 401
}

Missing Authorization Header

{
  "error": "Unauthorized",
  "message": "Authorization header required",
  "statusCode": 401
}

Insufficient Permissions

{
  "error": "Forbidden",
  "message": "Insufficient permissions for this resource",
  "statusCode": 403
}

Best Practices

Secure Storage

Store API keys securely using environment variables or secret management systems. Never hardcode them in your application.

# Environment variables
INFINITE_API_KEY=sk_live_your_key_here

# Or persist for the Infinite CLI
INFINITE_API_KEY=sk_live_your_key_here infinite auth login

Key Rotation

Regularly rotate your API keys for security. Generate new keys in the dashboard and update your applications before revoking old keys.

Environment Separation

Use different API keys for sandbox and production environments. This ensures proper isolation and prevents accidental production changes.

Webhook Authentication

Webhooks are authenticated using HMAC signatures. See our Webhooks Guide for details on verifying webhook authenticity.

Get started

Core Concepts

Guides

Authentication

Authentication

API Keys

Key Format

Making Authenticated Requests

Error Responses

Invalid API Key

Missing Authorization Header

Insufficient Permissions

Best Practices

Webhook Authentication

​Authentication

​API Keys

​Key Format

​Making Authenticated Requests

​Error Responses

​Invalid API Key

​Missing Authorization Header

​Insufficient Permissions

​Best Practices

​Webhook Authentication

Authentication

API Keys

Key Format

Making Authenticated Requests

Error Responses

Invalid API Key

Missing Authorization Header

Insufficient Permissions

Best Practices

Webhook Authentication