Authentication

The Imprint API uses API Keys to authenticate requests, and these are different for each environment. You can view and manage your API keys in the Imprint Dashboard. API authentication is performed via HTTP Basic Auth. Provide your API key as the basic auth username value. You do not need to provide a password. If you need to authenticate via bearer auth (e.g., for a cross-origin request), use -H "Authorization: Bearer 4eC39HqLyjWDarjtT1zdp7dc" instead of -u 4eC39HqLyjWDarjtT1zdp7dc.

curl https://dev.sbx.imprint.co/v2/customers \
  -u YOUR_API_KEY:

Scopes

Each API key carries a set of scopes that determine which endpoints it may call. Scopes are configured by your Imprint team based on your integration — see API key rotation for how initial keys are provisioned. The scope required by an individual endpoint is documented on that endpoint’s page under the REST API tab. Endpoints not listed below need no scope beyond a valid API key.

Scope	Grants access to
`ORDER_READ`	`GET /v2/orders`, `GET /v2/order_events`
`ORDER_WRITE`	`POST /v2/orders`, `PUT /v2/orders/{order_id}`, `DELETE /v2/orders/{order_id}`, `POST /v2/order_events`, `DELETE /v2/order_events/{order_event_id}`
`TRANSACTION_INTENT_READ`	`GET /v2/transaction_intents/{intent_id}`, `GET /v2/customers/{customer_id}/transaction_intents`
`TRANSACTION_INTENT_WRITE`	`POST /v2/transaction_intents`, `POST /v2/transaction_intents/{intent_id}`
`CARD_WRITE`	`POST /v2/payment_methods/{payment_method_id}/provision/{wallet}`
`ACCOUNT_READ`	`GET /v2/customers/{customer_id}/accounts`, `GET /v2/customers/{customer_id}/accounts/{account_id}`, `GET /v2/customers/{customer_id}/accounts/{account_id}/rewards_categories`, `GET /v2/customers/{customer_id}/accounts/{account_id}/statements`
`PCI_DETAILS_READ`	Unmasked card details (`card.pci_details`) on payment method responses
`AUTHORIZED_USER_READ`	Authorized user details (`authorized_users`) on `GET /v2/customers/{customer_id}`

Calling an endpoint with a key that lacks the required scope returns 403 Forbidden:

{
  "error": {
    "type": "FORBIDDEN_ERROR",
    "message": "forbidden"
  }
}

PCI_DETAILS_READ and AUTHORIZED_USER_READ are the exceptions — they never fail a request. Payment method endpoints succeed without PCI_DETAILS_READ, but omit card.pci_details (PAN, CVV, expiry) from the response. Retrieve Customer succeeds without AUTHORIZED_USER_READ, but omits authorized_users.

A new API key created via POST /v2/keys inherits exactly the scopes of the key used to create it. A key with no scopes creates another key with no scopes; rotation never adds newly enabled product scopes automatically.

Multi-Product Support

If your partnership spans multiple products (e.g., a parent company with several co-branded products), include the x-imprint-merchant-key header in your requests to specify which product the request applies to.

Header	Required	Description
`x-imprint-merchant-key`	No	Identifies the target product. Provided by your Imprint team during onboarding.

If you have multiple products, you must supply the merchant key in the header in order to retrieve information for that merchant/product:

curl https://dev.sbx.imprint.co/v2/customers \
  -u YOUR_API_KEY: \
  -H "x-imprint-merchant-key: your-merchant-key"

Getting Started

Applications

Cards

Transactions

Rewards

Account Linking

Webhook Event Notifications

API Keys

Servicing

Sandbox Testing

SDK Reference

Scopes

Multi-Product Support

​Scopes

​Multi-Product Support

Scopes

Multi-Product Support