Authentication

Every request (except the docs and the OpenAPI document itself) is authenticated with a Bearer API key, created from your API dashboard once you have access (see Getting access).

Sending the key

curl https://tcgplein.nl/api/v1/me \
  -H "Authorization: Bearer tcgp_live_K7mP2xQ9vZ4nR8wT3yL6bC1jD5sF0gH7uM2oA9iE"

curl_setopt($ch, CURLOPT_HTTPHEADER, [
    'Authorization: Bearer tcgp_live_K7mP2xQ9vZ4nR8wT3yL6bC1jD5sF0gH7uM2oA9iE',
]);

fetch(url, {
  headers: {
    Authorization: 'Bearer tcgp_live_K7mP2xQ9vZ4nR8wT3yL6bC1jD5sF0gH7uM2oA9iE',
  },
});

Key format

A key is the prefix tcgp_live_ followed by 40 random characters (50 characters in total). Only a hash of the key is stored on our side, which means:

The full key is shown exactly once, right after you create or rotate it. Copy it immediately.
If you lose it, there's no way to retrieve it: rotate or create a new one instead.
The dashboard only ever shows the first 14 characters (the prefix) of an existing key, so you can tell keys apart without exposing the secret again.

Scopes

Each key is issued with an explicit set of scopes. A request fails with 403 if the key doesn't carry the scope an endpoint requires, so grant only what an integration needs. The same list appears on the Values reference page.

Scope	Grants
`catalog:read`	Read sets, cards and sealed products.
`listings:read`	List your own listings.
`listings:write`	Create, update and delete your own listings.
`orders:read`	Read your orders.
`orders:write`	Generate shipping labels and mark orders shipped.
`webhooks:manage`	Register, list and remove webhook endpoints.

/me is the one exception: it only requires a valid, active key, no scope. That also makes GET /me the right first call to verify a freshly created key works.

Rotation

Rotating a key issues a brand new secret with the same name and scopes. The old secret keeps working for a 24 hour grace window, so you can swap the key in your integration without downtime; after that window it stops authenticating. Revoking a key, by contrast, is immediate and irreversible: there is no grace window.

401 vs 403

The two error types mean different things:

401 authentication_error: no key sent, or the key is unknown, revoked, or past its expiry.
403 authorization_error: the key is valid, but either it's missing the scope the endpoint needs, or the account behind it no longer has API access (access was never granted, was revoked, or the account is suspended).

See Errors for the full envelope shape and every error type the API returns.