Authentication

Authenticate every request with an API key pair sent over HTTP Basic authentication, plus an API version header.

The API authenticates every request with an API key pair sent with HTTP Basic authentication, plus an API version header.

​

Generate an API key

In the MyGigsters dashboard, go to Settings → API Keys and generate a key. You receive two values:

Value	Description
uuid	Your API key identifier (a UUID). Acts as the username.
randomPasswordShowOnce	Your API secret. Acts as the password. Shown only once at creation, so store it securely. If you lose it, generate a new key.

Keep your secret safe. Never put API credentials in client-side code, mobile apps, or public repositories. Make all API calls from your server. You can delete and regenerate API keys at any time from the dashboard.

​

Send credentials with every request

Base64-encode uuid:randomPasswordShowOnce and send it in the Authorization header. Also send the API version header.

Request headers

Authorization: Basic {base64(uuid:randomPasswordShowOnce)}
X-API-Version: 1.2
Content-Type: application/json

cURL

curl https://qa-payments.mygigsters.com.au/api/v1/customer/{customer_id} \
  -u "YOUR_UUID:YOUR_SECRET" \
  -H "X-API-Version: 1.2"

curl -u and the auth option build the Basic header for you.

​

The version header is required

Include X-API-Version: 1.2 on every request. Supported versions are 1.1 and 1.2.

If the header is missing or set to an unsupported version, the request is rejected with 400 Bad Request:

Missing header

{ "error": "Missing X-API-Version header. Supported versions are 1.1 and 1.2." }

​

Keys are environment-specific

A key generated in the demo (QA) dashboard does not work in production, and a production key does not work in demo. See Environments.

​

Related

API keys and rotation

Rotate keys with no downtime.

Restricted keys

Give each integration only the access it needs.