API Keys

API keys are used to authenticate requests to the Stigg GraphQL API. Include your key in the X-API-Key header with every request:

curl -X POST https://api.stigg.io/graphql \
  -H "Content-Type: application/json" \
  -H "X-API-Key: YOUR_API_KEY" \
  -d '{"query": "{ customers { edges { node { customerId name } } } }"}'

The GraphQL API accepts any server key — either the default full access key or a user-created scoped key.

Scoped API keys are available on the Scale plan. Without them, only the default full access and publishable keys are available.

Authentication errors

If the key is missing, invalid, or expired, the API returns 401 Unauthorized. If you use a scoped key that lacks permission for the requested operation, the API returns 403 Forbidden.

Key management

For key types, creating scoped keys, rotation, revocation, and access control, see the full API key management guide:

API key management

GraphQL API Overview Rate Limits

Overview

SDKs

Queries

Mutations

Types

Authentication errors

Key management

API key management

​Authentication errors

​Key management

API key management

Authentication errors

Key management