Authentication

Mascot provides an API key and a collector-specific auth token for the integration. Send both values as headers on every /api/public/v1 request:

curl 'https://app-api.withmascot.com/api/public/v1/items' \
  --header 'api_key: YOUR_API_KEY' \
  --header 'auth_token: COLLECTOR_AUTH_TOKEN'

Do not send either value in the query string or request body. Store both credentials securely and do not expose them in client-side code or logs.

The API key identifies the integration and the auth token identifies the collector. Mascot configures the scopes available to those credentials. Each endpoint in the API reference states its required scope.