Authentication

Closku uses API key-based authentication for all platform requests. Each merchant receives a set of credentials during onboarding consisting of an API Key that identifies the merchant account and an API Secret used for secure authentication. The secret should never be exposed client-side. API access is available for Enterprise plans, while standard plans use the low-code widget integration which handles authentication internally.

Every API request must include the API key in the request header:

Authorization: Bearer <api-key>

Requests without valid credentials receive a 401 Unauthorized response. Do not mix credential handling into unrelated workflow code; keep request authorization explicit and testable.

Treat authentication as the first gate for every integration action. Requests should be attributable, scoped, and easy to audit. Verify credentials early in the request lifecycle, fail closed when credentials are missing or invalid, and log enough context to debug without leaking sensitive material. Rotate secrets periodically and invalidate compromised keys immediately through the merchant portal. If something looks inconsistent, stop and resolve the trust boundary issue before continuing with downstream workflow logic.

API credentials are managed through the Closku merchant portal. Store secrets in environment variables or a secrets manager (never in code), and use separate keys for development and production environments. Rotate keys every 90 days or immediately after a suspected leak, and monitor the audit log in the merchant portal for any unusual API activity.