Skip to main content

Authentication

The Seddi Public API uses API keys to authenticate requests. Your API key must be included in every request via the x-api-key HTTP header.

Obtaining your API Key​

API keys are managed by your company directly from the Seddi Decorator settings page. Any user with access to your company account can create and manage keys on its behalf.

  1. Go to https://decorator.seddi.app/settings and sign in.
  2. Open the API / Developer panel.
  3. In the API Keys section you'll see every key currently active for your company. Click Create New Key.
  4. Enter a descriptive name (e.g. production-backend, staging-ci) and optionally an expiration date. Choose Never (or omit the date) if the key should not expire. If you set a date, it must be between 2 days and 1 year from today.
  5. The new key is shown only once. Copy it immediately and store it somewhere safe — for example, a secrets manager or your deployment environment's secret store. You will not be able to view it again from the UI; if you lose it, you'll have to create a new one.
Your key is shown only once

After the creation dialog closes, the full key value is no longer retrievable. If you didn't copy it, remove the key and create a new one.

Keep your key safe

Your API key grants access to all endpoints on behalf of your company. Do not share it publicly, commit it to version control, or expose it in client-side code.

Using your API Key​

Pass your API key in the x-api-key header on every request:

curl "https://seddi-public-api-gateway-91po835h.uc.gateway.dev/data/v1/brands?page=1&page_size=20" \
  -H "x-api-key: YOUR_API_KEY"

Best practices​

Store keys in environment variables, never hardcoded in source code:

# .env (never commit this file)
SEDDI_API_KEY=your_api_key_here
// Use it in your code
const apiKey = process.env.SEDDI_API_KEY;

Rotate keys periodically. Keys can be created without an expiration date; if you set one, it cannot be more than one year out. Rotate sooner if a key may have been exposed or when team members with access to it leave.

Rotating or revoking a key​

All key management is self-service from the same API / Developer panel at https://decorator.seddi.app/settings:

  • To revoke a key, click Remove on the right of the corresponding row in the API Keys list. The key stops working immediately — make sure no production workload is still using it before you remove it.
  • To rotate a key, create a new key first, roll it out to every application that uses the old one, verify traffic is flowing with the new key, then remove the old key.

If you suspect a key has been compromised, remove it immediately and issue a replacement. For anything you can't resolve from the settings page, contact support@seddi.com.

Authentication errors​

If your API key is missing or invalid, the API returns:

HTTP 401 Unauthorized

Check that:

  • The header name is exactly x-api-key (lowercase)
  • The key value has no leading/trailing whitespace
  • The key has not been revoked