Catalog AI
Sign In

Authentication

Learn how to authenticate your API requests.

API Key Authentication

All API requests require authentication using an API key. You can send it in either the x-api-key header or the Authorization header.

Preferred Header Format:

x-api-key: YOUR_API_KEY

Alternative Header Format:

Authorization: Bearer YOUR_API_KEY

Making Authenticated Requests

cURL

curl -X POST https://catalog-ai.tdcapps.com/api/your-org/products/get \
  -H "x-api-key: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{}'

JavaScript / TypeScript

const API_KEY = 'YOUR_API_KEY'
const ORG_ID = 'your-organization-id'
const BASE_URL = `https://catalog-ai.tdcapps.com/api/${ORG_ID}`

async function getProducts() {
  const response = await fetch(`${BASE_URL}/products/get`, {
    method: 'POST',
    headers: {
      'x-api-key': API_KEY,
      'Content-Type': 'application/json'
    },
    body: JSON.stringify({
      page: 1,
      limit: 20
    })
  })

  if (!response.ok) {
    throw new Error(`API error: ${response.status}`)
  }

  return response.json()
}

Python

import requests

API_KEY = 'YOUR_API_KEY'
ORG_ID = 'your-organization-id'
BASE_URL = f'https://catalog-ai.tdcapps.com/api/{ORG_ID}'

def get_products():
    headers = {
        'x-api-key': API_KEY,
        'Content-Type': 'application/json'
    }

    response = requests.post(
        f'{BASE_URL}/products/get',
        headers=headers,
        json={'page': 1, 'limit': 20}
    )
    response.raise_for_status()
    return response.json()

Creating API Keys

  1. Navigate to API Keys in your dashboard
  2. Click Create New API Key
  3. Configure expiration (optional)
  4. Copy and securely store the generated key

Important: The API key is shown only once. Store it securely.

Authentication Errors

401 Unauthorized

Missing or invalid API key.

{
  "success": false,
  "message": "Missing API Key"
}

Common causes:

  • Missing x-api-key or Authorization header
  • Invalid API key format
  • Expired or disabled API key

403 Forbidden

API key is valid but doesn't have access to the requested resource.

{
  "success": false,
  "message": "Invalid API Key"
}

Common causes:

  • API key doesn't belong to the specified organization
  • Attempting to access another organization's resources

Security Best Practices

Store Keys Securely

  • Use environment variables for API keys
  • Never commit keys to version control
  • Use secret management services in production
# .env file (never commit this)
TDC_API_KEY=your_api_key_here

Rotate Keys Regularly

  • Create new keys periodically (recommended: every 90 days)
  • Delete old keys after transitioning to new ones

Use HTTPS Only

All API requests must use HTTPS. HTTP requests are not supported.

Rate Limiting

API keys are subject to rate limits. When exceeded:

{
  "success": false,
  "message": "Rate limit exceeded"
}

Check response headers for rate limit information:

X-RateLimit-Limit: 100
X-RateLimit-Remaining: 0
X-RateLimit-Reset: 1640995200

Next Steps