> For the complete documentation index, see [llms.txt](https://dispatch-2.gitbook.io/integrate-with-dispatch/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://dispatch-2.gitbook.io/integrate-with-dispatch/authentication-api-keys.md).

# API Keys

Use an API key to call Dispatch from **your backend**—for example when a customer places an order on your website and you need to create a shipment automatically.

Your dashboard login is only for managing keys. Your **application** uses the API key.

**API base (staging):** `https://service.staging.dispattch.dev/api/v1`

***

## Create an API key (Merchant Dashboard)

1. Sign in at <https://merchants.staging.dispattch.dev>
2. Open **API Keys** in the sidebar.
3. Click **Generate New Key**, then **Generate Key**.
4. Copy the key from the dialog and click **I've saved the key**.

> **Important:** The full key is shown **only once**. If you lose it, delete the key in the dashboard, generate a new one, and update every service that calls Dispatch.

### Optional: verify a key in the dashboard

On the **API Keys** page you can open **Verify API Key**, paste a key string, and confirm it is still valid. This is useful when debugging configuration—not required for normal integrations.

***

## Add the key to your application

Store the key as a secret, for example:

```bash
# .env (never commit this file)
DISPATCH_API_KEY=dsp_your_key_here
```

**Do:**

* Load the key from environment variables or a secret manager (AWS Secrets Manager, Vault, etc.).
* Use it only in server-side code.

**Do not:**

* Put the key in JavaScript that runs in the browser.
* Commit the key to Git or share it in chat.
* Log the full key (mask it if you must log something).

***

## Use the key on every API request

Send your key in the **`X-API-KEY`** header on each request:

```http
GET /api/v1/shipments HTTP/1.1
Host: service.staging.dispattch.dev
X-API-KEY: dsp_your_key_here
```

### Example: create a shipment

```bash
curl -X POST "https://service.staging.dispattch.dev/api/v1/shipments" \
  -H "Content-Type: application/json" \
  -H "X-API-KEY: dsp_your_key_here" \
  -d '{
    "courier_company_id": 12,
    "start_address": "9.0123, 38.7465",
    "end_address": "9.0500, 38.8000",
    "description": "Order #10042",
    "weight_kg": 3.5,
    "dimensions": "30cm x 20cm x 10cm",
    "items": ["Item 1", "Item 2"]
  }'
```

Example response (`201 Created`):

```json
{
  "id": 4,
  "code": "SHP-1T74-F4E8",
  "merchant_id": 1,
  "status": "assigned_to_courier",
  "courier_company_id": 12,
  "description": "Order #10042",
  "weight_kg": 3.5,
  "total_fee": 119.25,
  "created_at": "2026-03-13T04:20:26.0731704+03:00"
}
```

### Example: get one shipment

```bash
curl "https://service.staging.dispattch.dev/api/v1/shipments/SHP-1T74-F4E8" \
  -H "X-API-KEY: dsp_your_key_here"
```

### Example: list shipments

```bash
curl "https://service.staging.dispattch.dev/api/v1/shipments?page=1&page_size=10" \
  -H "X-API-KEY: dsp_your_key_here"
```

***

## Endpoints you can call with an API key

These are the main operations available for server-to-server integration:

| Method | Path                                          | Purpose                                                |
| ------ | --------------------------------------------- | ------------------------------------------------------ |
| `POST` | `/shipments`                                  | Create a new shipment                                  |
| `GET`  | `/shipments`                                  | List shipments (supports filters and pagination)       |
| `GET`  | `/shipments/:code`                            | Get one shipment by code                               |
| `POST` | `/shipments/:code/cancel`                     | Cancel a shipment                                      |
| `POST` | `/shipments/:code/generate-confirmation-code` | Generate delivery confirmation code                    |
| `POST` | `/shipments/:code/rate`                       | Rate a delivered shipment                              |
| `GET`  | `/merchant-couriers`                          | List courier companies linked to your merchant account |

Replace `:code` with the shipment code returned when you create a shipment (for example `SHP-1T74-F4E8`).

***

## Rotate or revoke a key

**Rotate (recommended periodically or after a leak):**

1. In the dashboard, **Generate New Key** and copy the new value.
2. Deploy the new key to your servers (environment variables / secret manager).
3. Confirm traffic works (create or list a test shipment).
4. **Delete** the old key in the dashboard.

**Revoke immediately** if a key may have been exposed: delete it in **API Keys** first, then issue a new key and redeploy.

***

## Common problems

| Symptom              | What to check                                                              |
| -------------------- | -------------------------------------------------------------------------- |
| `401` / unauthorized | Key missing, wrong header name (`X-API-KEY`), or key revoked               |
| `403` forbidden      | Request targets a resource that does not belong to your merchant           |
| `400` bad request    | Invalid JSON or missing required fields (for example `courier_company_id`) |

Use the dashboard **Verify API Key** tool to confirm the key string you deployed is still valid.

***

## Advanced: manage keys via API (optional)

Creating and deleting keys normally happens in the **Merchant Dashboard**. If you automate merchant onboarding internally, management endpoints exist (`POST /api-keys`, `DELETE /api-keys/:id`) but require **dashboard login (Bearer token)**, not an API key. Most integrators only need the dashboard and `X-API-KEY` for shipment operations.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://dispatch-2.gitbook.io/integrate-with-dispatch/authentication-api-keys.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.