Authentication

Every request needs an API key, sent in the HTTP Authorization header.

Get your API key

Write to wino@isagri.com. There is one API key per environment, staging or production (see Environments).

Keep it secret

• Treat your key like a password. Store it in a secrets manager or an environment variable, never in your code repository.
• Use it only from a server. Never put it in a website, a mobile app or anything that runs on your customers' devices: anyone could read it there.
• If it leaks, write to wino@isagri.com right away.

Request with it

Add this header to every request, GraphQL and REST:

Authorization: Bearer <your API key>

The examples of this documentation read the key from an environment variable named WINO_API_KEY, so it never appears in your code. Set it once, for example with export WINO_API_KEY="<your API key>". The header, in each language:

curl

-H "Authorization: Bearer $WINO_API_KEY"

JavaScript

headers: {
  Authorization: `Bearer ${process.env.WINO_API_KEY}`;
}

PHP

'header' => 'Authorization: Bearer ' . getenv('WINO_API_KEY')

Python

headers={"Authorization": f"Bearer {os.environ['WINO_API_KEY']}"}

For a first complete request, see the Quickstart.

Without a valid key, the GraphQL API answers with an UNAUTHENTICATED error, and the webhooks API with 401 Unauthorized: see Errors.