Authentication

The Vendo REST API uses account-scoped API keys.

Each key belongs to a single account. Keys can be created with explicit scopes, and older keys without scopes continue to work with full account access for backwards compatibility.

Creating an API Key

1. Go to Settings
2. Open API Keys
3. Click Create API Key
4. Name the key for its purpose
5. Choose scopes if you want to restrict access
6. Copy the generated key immediately

The full key is only shown once.

API Key Format

vendo_sk_<random-string>

Using Your API Key

Include the key as a bearer token:

curl -H "Authorization: Bearer YOUR_API_KEY" \
  https://app2.vendodata.com/api/v1/apps

Scopes

API routes can require scopes such as:

• apps.write
• sources.write
• integrations.write
• models.write
• jobs.write

If a route does not require a scope, any valid API key can access it.

If a key has no scopes stored on it, Vendo treats it as full-access for backwards compatibility.

Example Errors

Missing API key:

{
  "error": {
    "code": "UNAUTHORIZED",
    "message": "Missing API key. Include Authorization: Bearer <your-api-key>"
  }
}

Invalid API key:

{
  "error": {
    "code": "UNAUTHORIZED",
    "message": "Invalid API key. The key may be expired, revoked, or incorrect."
  }
}

Insufficient scopes:

{
  "error": {
    "code": "FORBIDDEN",
    "message": "This API key does not have the required scopes: apps.write"
  }
}

Best Practices

1. Use separate keys for production, staging, and local tooling.
2. Prefer scoped keys for automation.
3. Rotate keys regularly.
4. Store keys in environment variables or a secrets manager.
5. Revoke unused keys promptly.

Environment Variable Example

export VENDO_API_KEY="vendo_sk_your-key-here"
 
curl -H "Authorization: Bearer $VENDO_API_KEY" \
  https://app2.vendodata.com/api/v1/me