Skip to main content

Authentication

The Courimax API uses API key authentication for all integration endpoints.

API Key Authentication​

Include your API key in the X-API-Key header with every request:

curl -H "X-API-Key: cmx_your_api_key" \
  https://api.courimax.com/api/integrations/yango/orders

Obtaining an API Key​

API keys are managed by organization administrators through the Provisioning API or the admin dashboard.

Via Provisioning API​

curl -X POST "https://api.courimax.com/api/provisioning/organizations/{orgId}/api-keys" \
  -H "X-Provisioning-Secret: your_secret" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Production API Key",
    "webhookUrl": "https://your-app.com/webhooks/courimax",
    "platform": "yango"
  }'

Response:

{
  "id": "key-id",
  "name": "Production API Key",
  "apiKey": "cmx_generated_key_value",
  "platform": "yango",
  "webhookUrl": "https://your-app.com/webhooks/courimax",
  "createdAt": "2026-08-19T10:00:00Z"
}

Important: The full API key is only shown once during creation. Store it securely.

API Key Security​

Keep Keys Secret​

  • Never expose API keys in client-side code
  • Use environment variables or secret management
  • Don't commit keys to version control

Rotate Keys Regularly​

Rotate API keys periodically or if compromised:

curl -X POST "https://api.courimax.com/api/provisioning/organizations/{orgId}/api-keys/{keyId}/rotate" \
  -H "X-Provisioning-Secret: your_secret"

Revoke Compromised Keys​

Immediately revoke keys that may be compromised:

curl -X DELETE "https://api.courimax.com/api/provisioning/organizations/{orgId}/api-keys/{keyId}" \
  -H "X-Provisioning-Secret: your_secret"

Authentication Errors​

401 Unauthorized​

{
  "statusCode": 401,
  "message": "Missing X-API-Key header",
  "error": "Unauthorized"
}

Solution: Include the X-API-Key header with a valid API key.

403 Forbidden​

{
  "statusCode": 403,
  "message": "API key does not match Yango integration",
  "error": "Forbidden"
}

Solution: Ensure your API key is associated with the correct integration platform.

Platform-Specific Keys​

API keys are scoped to specific integration platforms:

  • Yango: Keys for Yango delivery integration
  • Galaxis: Keys for Galaxis WMS integration
  • Floating Deli: Keys for Floating Deli merchant integration
  • Standard: General-purpose keys

Use the appropriate key for each integration endpoint.

Rate Limiting​

API keys are subject to rate limiting. See Rate Limits for details.

Next Steps​