Authenticate

The Brand API authenticates with the x-api-key header. The value is a key of type brand, created in the dashboard.

GET /brand/network/orders HTTP/1.1
Host: api.lomadee.com.br
x-api-key: lmd_prod_xxxxxxxxxx_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

Send the key only in the header, over HTTPS. Do not send it in the query string, and do not send a JWT (x-api-token) or the SDK x-auth-key.

What the key defines

A brand key carries three things. You do not send any of them as a parameter:

The key defines	Effect
Brand	Every response contains only data of the brand that owns the key. There is no `organizationId` parameter.
Vertical	A network key has only `network:` scopes and works only on `/brand/network/`; a white-label key has only `whitelabel:` scopes and works only on `/brand/whitelabel/`.
Scopes	Each route requires one scope. See the scope table.

Status	Code	Cause
`401`	`UNAUTHORIZED`	Missing header, invalid, expired or revoked key, or a key that is not a brand key (for example an affiliate key)
`403`	`FORBIDDEN`	Valid brand key of the other vertical, or without the scope of the route
`429`	`TOO_MANY_REQUESTS`	Rate limit exceeded, or too many requests with an invalid key from the same address

A 401 means the key is not accepted at all. A 403 means the key is valid but cannot call that route.