Shakewell Wallet

API authentication with API keys

Authenticate to the Shakewell Wallet REST API with an API key sent as a Bearer token or an X-API-Key header. How to create, scope and revoke keys.

Last updated 2026-11-05

Every request to the public API (https://api.shakewellwallet.com/api/public/v1) is authenticated with an API key that belongs to one account. There is no OAuth flow and no separate test environment: a key acts on the account that created it.

Create a key

  1. Sign in to the dashboard and open Settings, then Account settings, then API keys.
  2. Create a key, give it a name and choose an access level: read, or read and write.
  3. Copy the key now. It starts with sk_ and is shown once. Shakewell stores only a SHA-256 hash and a short hint, so a lost key cannot be recovered, only replaced.
Creating keys needs a plan with API access. On a plan without it, the key endpoint answers 403 with feature_required. See the pricing page for which plans include the API.

Send the key

Either header works. Send Accept: application/json so errors come back as JSON.

Headers
Authorization: Bearer sk_xxxxxxxxxxxxxxxx
# or
X-API-Key: sk_xxxxxxxxxxxxxxxx

Access levels

A read key can list and fetch templates. A read and write key can also create, update and delete them. An admin permission implies both. The template endpoints enforce this and answer 403 when the key lacks it.

What authentication errors look like

SituationStatusBody
No key sent401{"error":"Unauthorized","message":"API Key is required."}
Unknown, revoked, inactive or expired key401{"error":"Unauthorized","message":"Invalid API key."}

Invalid-key attempts are logged with the caller IP. Keep keys in a secret manager and never ship them in browser or mobile code.