Authentication

How to authenticate with the EUlabel API using API keys or session-based authentication.

The EUlabel API supports two authentication methods depending on your use case.

API Key (Bearer Token)

For machine-to-machine integrations, scripts, and CI pipelines. Include your API key in the Authorization header:

curl https://api.eulabel.eu/v1/products \
  -H "Authorization: Bearer sk_live_YOUR_API_KEY"

API keys are scoped to a specific organization and can be restricted to specific permissions.

Property	Description
Format	`sk_live_` prefix (production) or `sk_test_` prefix (sandbox)
Scope	Per organization, per environment
Use cases	PIM webhook delivery, bulk data sync, CI/CD pipelines

For browser-based access through the EUlabel Dashboard:

Property	Description
Provider	WorkOS (SAML, OIDC, Google, Microsoft)
Session	Server-side with refresh token rotation
Use cases	Dashboard access, API key management

Every API key is assigned one or more permission scopes that control what resources it can access.

Scope	Grants
`products:read`	List and get products, passports, QR codes
`products:write`	Create products
`passports:read`	Read passport data
`passports:write`	Create and publish passports
`suppliers:read`	List suppliers
`suppliers:write`	Create suppliers
`analytics:read`	View scan analytics
`api_keys:manage`	Manage API keys (session only)

Status	Meaning
401	Missing or invalid API key
403	Valid API key but insufficient permissions for this endpoint