Introduction

Authentication

Basta uses two credential models: static API credentials for the server-side Management API, and short-lived bidder tokens for user actions on the Client API.

Which credentials you use depends on which API you call. Configure and operate sales from your backend with the Management API, and surface auctions and place bids from your app with the Client API.

Need to set up your account or issue your first API key first? See Getting Started.

Management API: static credentials

The Management API is authenticated with static credentials generated from your dashboard's Settings section. Every request must include both headers:

JSON

{
  "x-account-id": "YOUR_ACCOUNT_ID",
  "x-api-key": "YOUR_API_KEY"
}

These headers are required for both authenticated queries and mutations.

A minimal authenticated request looks like this:

Shell

curl -X POST https://management-api.basta.app/graphql \
  -H "Content-Type: application/json" \
  -H "x-account-id: YOUR_ACCOUNT_ID" \
  -H "x-api-key: YOUR_API_KEY" \
  -d '{"query": "{ __typename }"}'

Keep your API key secret. It grants back-office access, so use it only from server-side code and store it in environment variables — never ship it in a browser or mobile client.

Client API: bidder tokens

The Client API accepts either unauthenticated requests (for public reads such as browsing auctions) or bidder-scoped JWT tokens for user actions such as placing bids. Because Basta does not manage your end users, your backend generates bidder tokens via the Management API and passes them to your client.

Send the token in the Authorization header on Client API requests:

JSON

{
  "Authorization": "Bearer <BIDDER_JWT>"
}

The userId embedded in the token resolves bids and subscriptions in the user's context. See the Client API for how to generate and use bidder tokens.

Support

For questions or assistance with API access, email us at hi@basta.app.