Skip to main content
Every request to the WISEPIM Public API carries a project API key as a bearer token. There is no OAuth flow, no session and no other sign-in step for the API: the key is the credential.

​
How keys work

  • One key, one project. A key is bound to the project it was created in and can never reach another project. A product id from another project is a 404, not a 403.
  • Scopes are fixed at creation. You choose the permissions when you create the key. They cannot be widened afterwards; create a new key instead.
  • Keys act on behalf of the person who created them. Every request re-checks that this person is still active and still has access to the project. Write scopes also require that they can still edit the project. Off-board the person and their keys stop with them.
  • Only the prefix is stored. WISEPIM keeps a hash of the key, so the full wpk_... value is shown exactly once, right after creation or rotation.
  • Revocation and expiry apply on the next request. Nothing is cached.
Keys are created under Settings > API Access by project owners and admins. See API Access for the walkthrough and the limits per project and per person.

​
Scopes

Request the smallest set that does the job. Reads and writes are separate scopes. GET /me needs no scope. Call it first to confirm which key you are holding, which scopes it carries and which project every other call will land in. The same scope names appear in the OpenAPI spec: each operation lists its scope under x-required-scopes, and the ProjectApiKeyAuth security scheme describes the full catalogue under x-scopes.

​
Authentication errors

​
Keep keys safe

  • Send keys from your server, never from browser code, mobile apps or public repositories.
  • Store them in environment variables or a secrets manager, not in source control.
  • Give each integration its own key so you can revoke one without breaking the others.
  • Check each key’s Last used date under Settings > API Access and revoke keys that are no longer in use.
  • If a key may have leaked, create a replacement, switch the integration to it, then Revoke the old one. Revocation is immediate.

​
For AI assistants

Project API keys are for code you run yourself. To let ChatGPT or Codex work with a catalog, connect it through Connected Apps: the assistant asks for named permissions, you approve exactly one project, and you choose whether its changes apply directly or wait for your review in WISEPIM. That connection is granted and revoked in the app, not with an API key.