Authentication

The RewardOS B2B API uses a tenant-scoped API key. Keep the key on your server; never include it in a browser, mobile app, WebView, or client-side bundle.

Request header

Send the API key with every B2B API request:

x-api-key: rwos_test_...

Authorization: Bearer <api-key> is accepted for compatibility, but new integrations should use x-api-key.

Verify your credentials

GET /b2b/whoami is a read-only endpoint that confirms the tenant and API client bound to the supplied key. Use it during setup and after rotating a key.

curl "$REWARDOS_API_BASE/b2b/whoami" \
  -H "x-api-key: $REWARDOS_API_KEY"

Failed authentication

An absent or invalid key returns 401:

{
  "error": {
    "code": "unauthorized",
    "message": "Invalid API key",
    "requestId": "..."
  }
}

Next steps

1. Configure your environment
2. Read the catalog
3. Create purchases safely