Authentication

All requests to the Pixee PIM API must be authenticated. The API supports two authentication methods: API keys (recommended for integrations) and JWT Bearer tokens (for user sessions).

API keys

API keys are long-lived credentials prefixed with pm_live_ (production) or pm_test_ (test). You can create and manage them in your account settings.

Using an API key

Pass the key in the X-API-Key header on every request:

curl https://api.pixeepim.com/api/v1/products \
  -H "X-API-Key: pm_live_abc123..."

API key scopes

Each key is restricted to a set of scopes:

Creating an API key

1. Log in at pixeepim.com.
2. Navigate to Settings → API Keys.
3. Click Create API Key, enter a descriptive name and select the required scopes.
4. Copy the key immediately — it won't be shown again.

Rotating a key

curl -X POST https://api.pixeepim.com/api/v1/api-keys/{key_id}/rotate \
  -H "X-API-Key: pm_live_abc123..."

The old key is invalidated immediately and a new one is returned.

JWT Bearer tokens

User sessions use short-lived JWT tokens (valid for 15 minutes by default). Obtain a token via the login endpoint:

curl -X POST https://api.pixeepim.com/api/v1/auth/login \
  -H "Content-Type: application/json" \
  -d '{"email": "you@example.com", "password": "••••••••"}'

{
  "access_token": "eyJhbGc...",
  "token_type": "bearer"
}

Use the token in the Authorization header just like an API key:

curl https://api.pixeepim.com/api/v1/products \
  -H "Authorization: Bearer eyJhbGc..."

To refresh an expiring token:

The refresh token is sent automatically via the refresh_token HttpOnly cookie set at login. No Authorization header needed for this endpoint.

curl -X POST https://api.pixeepim.com/api/v1/auth/refresh \
  -H "Content-Type: application/json"

Multi-tenant context

If your account manages multiple tenants, scope a request to a specific tenant with the X-Tenant-ID header:

curl https://api.pixeepim.com/api/v1/products \
  -H "X-API-Key: {api_key}" \
  -H "X-Tenant-ID: {tenant_id}"

Without this header, the request operates on your default account context.

Error responses

See the Errors guide for the full error format.