Authentication

All API requests require a valid API key sent as a Bearer token in the Authorization header.

Creating an API key

API keys are created in the Beach Depository dashboard under Settings > API Keys. Each key is scoped to a single organization.

Keys follow the format:

pv_live_<64-hex-chars>

Each API key has granular permissions that control which endpoints it can access. Available permission scopes are:

organizations:read, organizations:update
members:read
fbo_accounts:read, fbo_accounts:create, fbo_accounts:update
inventory:read
inbound_shipments:read, inbound_shipments:create
outbound_requests:read, outbound_requests:create, outbound_requests:update
outbound_shipments:read
transfer_batches:read, transfer_batches:create
return_shipments:read
webhooks:manage

A request to an endpoint without the required permission returns a 403 Forbidden error. Holding-statement endpoints require organizations:read.

Include the key in the Authorization header:

curl https://api.beachdepository.com/v1/fbo-accounts \
  -H "Authorization: Bearer pv_live_abc123..."

Keys can be disabled temporarily or revoked permanently from the dashboard.

Disable — pauses the key; you can re-enable it later.
Revoke — permanently invalidates the key. Usage history is retained for audit.

Disabled and revoked keys return 401 Unauthorized on API requests.