Authentication

API Base URL

https://api.tribemade.in

All API requests should be made to this base URL. Append the endpoint path to make requests.

How Authentication Works

TribeMade API uses API key authentication via the X-API-Key header. All API requests must include your API key to authenticate.

API keys are store-specific. Each store has its own unique API key, and the key only works for that store’s data.

Getting Your API Key

Visit TribeMade Dashboard and select your store.

Navigate to Developer section

Click on Developer in the sidebar (below Settings).

Generate API key

Click “Generate API Key” to create your key. It will be displayed immediately.

Store securely

Copy your API key and store it securely. You’ll need it for all API requests.

API Key Format

Your API key follows this pattern:

tb-xxxx-xxx-xxxx

Example: tb-a1b2-c3d-e4f5

Length: 16 characters
Prefix: Always starts with tb-
Scope: Store-specific

Using Your API Key

Include your API key in the X-API-Key header for every API request.

curl https://api.tribemade.in/api/orders/770e8400-e29b-41d4-a716-446655440789 \
  -H "X-API-Key: tb-a1b2-c3d-e4f5"

import requests

headers = {
    "X-API-Key": "tb-a1b2-c3d-e4f5"
}

response = requests.get(
    "https://api.tribemade.in/api/orders/770e8400-e29b-41d4-a716-446655440789",
    headers=headers
)

const fetch = require('node-fetch');

const headers = {
    'X-API-Key': 'tb-a1b2-c3d-e4f5'
};

fetch('https://api.tribemade.in/api/orders/770e8400-e29b-41d4-a716-446655440789', {
    headers: headers
})
.then(response => response.json())
.then(data => console.log(data));

<?php
$ch = curl_init();

curl_setopt($ch, CURLOPT_URL, 
    'https://api.tribemade.in/api/orders/770e8400-e29b-41d4-a716-446655440789');
curl_setopt($ch, CURLOPT_HTTPHEADER, array(
    'X-API-Key: tb-a1b2-c3d-e4f5'
));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);

$response = curl_exec($ch);
curl_close($ch);

echo $response;
?>

Authentication Errors

401 Unauthorized - Missing API Key

{
  "error": "Missing API key"
}

Cause: You forgot to include the X-API-Key header in your request. Fix: Add the header with your API key:

-H "X-API-Key: tb-a1b2-c3d-e4f5"

401 Unauthorized - Invalid API Key

{
  "error": "Invalid API key"
}

Causes:

The API key is incorrect or has been regenerated
The API key belongs to a different store
The API key format is invalid

Fix: Generate a new API key from your dashboard and update your code.

Security Best Practices

Never expose API keys publicly

Don’t:

Commit API keys to Git/GitHub
Include API keys in client-side JavaScript
Share API keys in public forums or chat
Hardcode API keys in your source code

Do:

Store API keys in environment variables
Use server-side code only
Keep API keys in secure vaults (AWS Secrets Manager, etc.)

Regenerate compromised keys immediately

If your API key is exposed or compromised:

Go to Developer section in your dashboard
Generate a new API key immediately
Update your application with the new key
The old key will stop working instantly

Use environment variables

Store your API key in environment variables:

.env

TRIBEMADE_API_KEY=tb-a1b2-c3d-e4f5

Then access it in your code:

Python

import os
api_key = os.environ.get('TRIBEMADE_API_KEY')

Node.js

const apiKey = process.env.TRIBEMADE_API_KEY;

Never log API keys

Avoid logging API keys in:

Application logs
Error messages
Debug output
Monitoring dashboards

Mask or redact API keys in logs:

API Key: tb-****-***-****

Use HTTPS only

Always use HTTPS when making API requests. Never use HTTP - it transmits your API key in plain text.✅ Correct: https://api.tribemade.in
❌ Wrong: http://api.tribemade.in

Scope and Permissions

Your API key has full access to:

✅ Create, edit, and delete products
✅ View order details
✅ Update order statuses
✅ All data for your specific store

Your API key cannot:

❌ Access other stores’ data
❌ Modify store settings
❌ Create or delete store
❌ Manage team members

Anyone with your API key can manage your products and orders. Treat it like a password and keep it secure!

Example: Secure Implementation

Here’s an example of a secure API key implementation:

import os
import requests
from flask import Flask, jsonify

app = Flask(__name__)

# Load API key from environment variable
API_KEY = os.environ.get('TRIBEMADE_API_KEY')
BASE_URL = 'https://api.tribemade.in'

def get_order(order_id):
    headers = {'X-API-Key': API_KEY}
    response = requests.get(
        f'{BASE_URL}/api/orders/{order_id}',
        headers=headers
    )
    return response.json()

@app.route('/orders/<order_id>')
def fetch_order(order_id):
    try:
        order = get_order(order_id)
        return jsonify(order)
    except Exception as e:
        # Don't expose API key in errors
        return jsonify({'error': 'Failed to fetch order'}), 500

const express = require('express');
const fetch = require('node-fetch');

const app = express();

// Load API key from environment variable
const API_KEY = process.env.TRIBEMADE_API_KEY;
const BASE_URL = 'https://api.tribemade.in';

async function getOrder(orderId) {
    const headers = {'X-API-Key': API_KEY};
    const response = await fetch(
        `${BASE_URL}/api/orders/${orderId}`,
        { headers }
    );
    return response.json();
}

app.get('/orders/:orderId', async (req, res) => {
    try {
        const order = await getOrder(req.params.orderId);
        res.json(order);
    } catch (error) {
        // Don't expose API key in errors
        res.status(500).json({ error: 'Failed to fetch order' });
    }
});

app.listen(3000);

Next Steps

Product APIs

Start managing products programmatically

Order APIs

Fetch and update order information

Webhooks

Receive real-time order notifications

Rate Limits

Understand API rate limits

Getting Started

Core Concepts

API Base URL

How Authentication Works

Getting Your API Key

API Key Format

Using Your API Key

Authentication Errors

401 Unauthorized - Missing API Key

401 Unauthorized - Invalid API Key

Security Best Practices

Scope and Permissions

Example: Secure Implementation

Next Steps

Product APIs

Order APIs

Webhooks

Rate Limits

​API Base URL

​How Authentication Works

​Getting Your API Key

​API Key Format

​Using Your API Key

​Authentication Errors

​401 Unauthorized - Missing API Key

​401 Unauthorized - Invalid API Key

​Security Best Practices

​Scope and Permissions

​Example: Secure Implementation

​Next Steps

Product APIs

Order APIs

Webhooks

Rate Limits

API Base URL

How Authentication Works

Getting Your API Key

API Key Format

Using Your API Key

Authentication Errors

401 Unauthorized - Missing API Key

401 Unauthorized - Invalid API Key

Security Best Practices

Scope and Permissions

Example: Secure Implementation

Next Steps