Authentication
API keys, request headers, and public Partners API routes
Authenticate Partners API data requests using an API key sent in the Authorization header. The documentation routes listed below are public.
Partners API access must be enabled on your plan. API keys are issued and managed by a Basker administrator; the standard account screen does not provide self-service key generation.
Steps
1. Get an API key
Ask your Basker contact or an authorised platform administrator to issue a key. Store it as a secret and replace it if it is lost or exposed.
2. Include the key in every data request
Set the Authorization header with the prefix users API-Key followed by a space and then your key.
curl -s \
-H "Authorization: users API-Key a1b2c3d4-e5f6-7890-abcd-ef1234567890" \
-H "x-basker-tenant-slug: remarkable-theatre" \
"https://api.basker.app/partners/2026-02/remarkable-theatre/pages"3. Verify authentication is working
If the key is valid, you receive the expected JSON response. If it is missing or invalid, the API returns:
{
"error": "Unauthorized",
"message": "Valid API key required"
}HTTP status: 401.
Header format
The header value must follow this exact format:
Authorization: users API-Key <your-api-key>| Component | Value | Notes |
|---|---|---|
| Scheme | users API-Key | Not Bearer. Not API-Key alone. The prefix users API-Key is required exactly as shown, including the space. |
| Key | Your generated key | The raw key string, not base64-encoded |
Correct:
Authorization: users API-Key a1b2c3d4-e5f6-7890-abcd-ef1234567890Incorrect:
Authorization: Bearer a1b2c3d4-e5f6-7890-abcd-ef1234567890
Authorization: API-Key a1b2c3d4-e5f6-7890-abcd-ef1234567890
Authorization: users api-key a1b2c3d4-e5f6-7890-abcd-ef1234567890Keep keys safe
- Store keys in a server-side secrets manager or environment variable.
- Never expose a Partners API key in browser JavaScript.
- Replace a key if it is lost, committed, logged, or otherwise exposed.
Public routes
The following routes do not require authentication:
| Route | Purpose |
|---|---|
GET /partners/openapi | OpenAPI specification |
GET /partners/{version}/openapi | OpenAPI specification for a supported version |
GET /partners/docs | Swagger UI |
GET /partners/{version}/{tenant}/graphql with Accept: text/html and no query | GraphiQL interface |
All other /partners/ routes require a valid API key.
Using API keys with the native Basker CMS API
API keys are only accepted by the Partners API at /partners/. If you send an Authorization: users API-Key header to the native Basker CMS REST API at /api/, the request is rejected with a 403 Forbidden response:
{
"error": "Forbidden",
"message": "API keys must use the Partners API at /partners/:version/:tenant/*"
}Troubleshooting
"Unauthorized -- Valid API key required" The key is missing or malformed. Check the stored secret and ask the administrator who issued it to replace it if necessary.
"Forbidden -- API keys must use the Partners API"
You sent the users API-Key header to /api/ instead of /partners/. Change the URL to use the Partners API path.
Related
- Tutorial: Make your first API call -- step-by-step first request
- Understanding multi-tenancy -- how tenant context works alongside authentication
- Error reference -- all error codes and responses