Authenticate requests

Every request is authenticated with an API key sent in the X-API-KEY header.

curl https://api.correctinbox.com/v1/accounts \
  -H "X-API-KEY: $CORRECTINBOX_API_KEY"

fetch("https://api.correctinbox.com/v1/accounts", {
  headers: { "X-API-KEY": process.env.CORRECTINBOX_API_KEY },
});

requests.get(
    "https://api.correctinbox.com/v1/accounts",
    headers={"X-API-KEY": os.environ["CORRECTINBOX_API_KEY"]},
)

Creating keys

Create and revoke keys in the dashboard under Settings → API keys. A key is shown in full only once, at creation. Store it somewhere safe immediately.

Keys are prefixed so you can tell them apart at a glance:

Prefix	Environment
sk_live_	Live — acts on real connected accounts
sk_test_	Test — safe sandbox, no real provider activity

Keep keys on the server

An API key can act on every account in your workspace, so never ship it to a browser, mobile app, or public repository. Call CorrectInbox from your backend and expose only the results your own app needs.

Errors

Status	type	Meaning
401	invalid_api_key	The key is missing, malformed, or revoked.
403	insufficient_scope	The key is valid but not allowed to perform this action.

A missing or bad key always returns 401:

{
  "object": "error",
  "type": "invalid_api_key",
  "status": 401,
  "detail": "No API key was provided in the X-API-KEY header.",
  "request_id": "req_a1b2c3"
}