Can I use the same key in CI and production?

Use sk_lab_ for customer-side development, sk_cert_ for third-party testing, and sk_live_ for Production. Keys cannot cross lanes. Rotate credentials on a schedule and revoke compromised keys immediately.

Authentication

EDI API authentication

How SignalEDI platform API keys work: Bearer auth, platform vs workspace scopes, rotation, and rate-limit headers.

Start free trial API reference

Quick answer

Which environment variable should I use?

SIGNALEDI_API_KEY is the conventional name across docs and samples. Store it in your secret manager — never commit live keys.

Bearer token pattern

Every /api/v1 request carries Authorization: Bearer <SIGNALEDI_API_KEY>. Missing or invalid keys return 401 without leaking tenant details.

Authorization: Bearer $SIGNALEDI_API_KEY

Scopes

Platform-scoped keys power developer integrations (/api/v1/*). Each key has one persisted LAB, CERTIFICATION, or PRODUCTION authority. The server rejects cross-lane requests. Workspace-scoped keys remain tied to dashboard flows.

Platform scope → developer console + /api/v1
Workspace scope → tenant dashboard APIs
sk_lab_ → LAB; sk_cert_ → CERTIFICATION; sk_live_ → PRODUCTION
Historical sk_test_ credentials and SANDBOX request values resolve to Certification only

Rate limits

Responses include X-RateLimit-Limit, X-RateLimit-Remaining, and X-RateLimit-Reset. Back off with jitter when you receive 429.

FAQ

Common questions