Authentication

The EUlabel API supports two authentication methods depending on your use case.

At a glance

Server-to-server integrations: use an API key (Bearer token).
Dashboard usage: use a session cookie (WorkOS-backed).
Rule of thumb: never put secrets in the browser.

API key (Bearer token)

CI/CD, PIM sync, backend services — fastest and simplest for integrations

Session cookie

For logged-in dashboard usage — not recommended for service integrations

Never expose API keys in client-side code, public repositories, or browser JavaScript. API keys grant full access to your organization's data and should only be used in server-side code.

API Key (Bearer Token)

For machine-to-machine integrations, scripts, and CI pipelines. Include your API key in the Authorization header:

export EULABEL_API_KEY="sk_test_..."

curl https://api.eulabel.eu/v1/products \
  -H "Authorization: Bearer $EULABEL_API_KEY"

const EULABEL_API_KEY = process.env.EULABEL_API_KEY;

const response = await fetch('https://api.eulabel.eu/v1/products', {
  headers: { 'Authorization': `Bearer ${EULABEL_API_KEY}` },
});

import requests

EULABEL_API_KEY = "sk_test_..."

response = requests.get(
    "https://api.eulabel.eu/v1/products",
    headers={"Authorization": f"Bearer {EULABEL_API_KEY}"},
)

API keys are scoped to a specific organization and can be restricted to specific permissions.

Property	Description
Format	`sk_live_` prefix (production) or `sk_test_` prefix (sandbox)
Scope	Per organization, per environment
Use cases	PIM webhook delivery, bulk data sync, CI/CD pipelines

For browser-based access through the EUlabel Dashboard:

Property	Description
Provider	WorkOS (SAML, OIDC, Google, Microsoft)
Session	Server-side with refresh token rotation
Use cases	Dashboard access, API key management

Permissions (Scopes)

Every API key is assigned one or more permission scopes that control what resources it can access.

Scope	Grants
`products:read`	List and get products, passports, QR codes
`products:write`	Create products
`passports:read`	Read passport data
`passports:write`	Create and publish passports
`suppliers:read`	List suppliers
`suppliers:write`	Create suppliers
`analytics:read`	View scan analytics
`api_keys:manage`	Manage API keys (session only)