Authentication

The SODA-API-KEY header

Pass your key in the SODA-API-KEY header on every request:

curl --request GET \
     --url 'https://biz-sandbox-api.sodagift.com/v1/accounts/balance' \
     --header 'SODA-API-KEY: YOUR-API-KEY'

If the key is missing, malformed, or revoked, the API responds with 401 Unauthorized and an empty body.

Key format and environments

Keys only work in the environment they were issued for. A sodagift_test_ key against the production URL (or vice versa) returns 401.

Managing keys

Keys are created, viewed, and revoked in the dashboard under Settings > Developer Settings.

To rotate a key: generate a new key, deploy it, then delete the old one. There is no built-in expiry — rotation is your responsibility.

Keep your key secret

Your API key can create orders that spend your account balance. Treat it like a password:

• Store it in a secret manager or environment variable, never in source control or client-side code.
• Call the API only from your servers — never from browsers or mobile apps.
• If a key may have been exposed, delete it in the dashboard immediately and issue a new one.