Authentication

All requests to the Mediloop Supplier API must be authenticated. We support API Key authentication using the X-API-Key header.

How it works

Create an API key

Generate your API key from the Mediloop Developer Portal.

Include the key

Add your API key to the X-API-Key header in every request.

Make your request

Call endpoints based on the scopes assigned to the key.

Example request

GET /v1/products

X-API-Key: ml_live_1234567890abcdef
X-Tenant-Id: 2f8c9d41-68a6-4b36-8a5b-f8d1c2e3f4a77
Content-Type: application/json

API Keys

Unique per partner

Each key is unique and cannot be shared.

Secure by design

HTTPS only; credentials remain encrypted at rest.

Revocable

Revoke or rotate keys at any time.

Scoped permissions

Keys are role-based with fine-grained scopes.

Keep your API keys secure and never share them in public repositories, client-side code, or logs.

Authentication header

curl -X GET "https://api.mediloop.com/v1/products?limit=20" \
  -H "X-API-Key: ml_live_1234567890abcdef" \
  -H "X-Tenant-Id: 2f8c9d41-68a6-4b36-8a5b-f8d1c2e3f4a77" \
  -H "Accept: application/json"

Response (200 OK)

{
  "success": true,
  "data": {
    "items": [...],
    "page": 1,
    "limit": 20,
    "total": 84
  }
}

Rate limits

Rate-limit headers are returned with API responses. Respect RateLimit-Limit, RateLimit-Remaining and RateLimit-Reset.

Token rotation

Create the replacement key, deploy it, verify successful requests, then revoke the previous key. Keep the overlap window short.

Best practices

Use environment variables or a secrets manager, separate keys per environment, grant minimum scopes and monitor key usage.

Troubleshooting

For 401/403 responses, verify the API key, tenant context and assigned scopes before retrying.