Authentication

Authenticate Partners API data requests with an API key in the Authorization header. The documentation routes below are public.

Steps

1. Get an API key

Ask your Basker contact or an authorized platform administrator to issue a key. Store the key as a secret. If the key is lost or exposed, replace it.

2. Include the key in every data request

Set the Authorization header with the prefix users API-Key followed by a space and then your key.

curl -s \
  -H "Authorization: users API-Key a1b2c3d4-e5f6-7890-abcd-ef1234567890" \
  -H "x-basker-tenant-slug: remarkable-theatre" \
  "https://api.basker.app/partners/2026-02/remarkable-theatre/pages"

3. Verify authentication is working

If the key is valid, you receive the expected JSON response. If it is absent or invalid, the API returns:

{
  "error": "Unauthorized",
  "message": "Valid API key required"
}

HTTP status: 401.

Header format

The header value must follow this exact format:

Authorization: users API-Key <your-api-key>

Correct:

Authorization: users API-Key a1b2c3d4-e5f6-7890-abcd-ef1234567890

Incorrect:

Authorization: Bearer a1b2c3d4-e5f6-7890-abcd-ef1234567890
Authorization: API-Key a1b2c3d4-e5f6-7890-abcd-ef1234567890
Authorization: users api-key a1b2c3d4-e5f6-7890-abcd-ef1234567890

Keep keys safe

• Store keys in a server-side secrets manager or environment variable.
• Never expose a Partners API key in browser JavaScript.
• If a key is lost, committed, logged, or otherwise exposed, replace it.

Public routes

The following routes do not require authentication:

All other /partners/ routes require a valid API key.

Using API keys with the native Basker CMS API

The Partners API at /partners/ only accepts API keys. The native Basker CMS REST API at /api/ does not accept the Authorization: users API-Key header. It rejects the request with a 403 Forbidden response:

{
  "error": "Forbidden",
  "message": "API keys must use the Partners API at /partners/:version/:tenant/*"
}

Troubleshooting

"Unauthorized -- Valid API key required" The key is absent or malformed. Check the stored secret. If necessary, ask the administrator who issued it to replace the key.

"Forbidden -- API keys must use the Partners API" You sent the users API-Key header to /api/ instead of /partners/. Change the URL to use the Partners API path.

Related

• Tutorial: Make your first API call -- step-by-step first request
• Understanding multi-tenancy -- how tenant context works alongside authentication
• Error reference -- all error codes and responses