Authentication

The v1 API authenticates with a bearer token. Keys are issued per organization.

Getting a key

Keys are minted from the Passport admin panel under Admin → API Keys. A key is the string pk_ followed by 48 hexadecimal characters.

Send the key in the Authorization header:


curl -H "Authorization: Bearer pk_your_key_here" \
  https://demo.stellarpassport.xyz/api/v1/events

Every v1 endpoint requires this except GET /api/v1/organizations/[slug]/page, which is public.

A missing, malformed, or revoked key returns 401 with:


{ "error": "Invalid or missing API key" }

The response does not distinguish between these cases.

A Passport API key identifies your organization. Treat it like a password.

Call from a server, never a browser. Anything in client-side JavaScript is readable by anyone who opens devtools. If you need Passport data in a web page, proxy it through your own backend.
Keep it out of version control. Use an environment variable or your platform’s secret store.
Rotate it from Admin → API Keys if it may have been exposed.
Use one key per integration, so you can revoke one without breaking everything else.