Authentication

All Swipe API requests are authenticated with an API key sent as a Bearer token.

Base URL

Every endpoint in this documentation is relative to:

https://app.getswipe.in/api/partner

For example, the Create a document endpoint POST /v2/doc resolves to https://app.getswipe.in/api/partner/v2/doc.

The key is tied to your Swipe account — every document, customer, and product you create through the API belongs to that account.

Send the key in the Authorization header of every request:

curl --request GET \
  --url https://app.getswipe.in/api/partner/v2/product/list \
  --header "Authorization: Bearer YOUR_API_KEY"

In the API playground, paste the key into the Authorization field and it is applied to every try-it request.

Requests with a missing or invalid key fail with HTTP 401 and one of these error codes:

`error_code`	Meaning
`UNAUTHORIZED`	The key is missing, malformed, or invalid. Check the header format.
`FORBIDDEN`	The key is not allowed to perform this action.

See Error codes for the full list.

Your API key grants full access to your Swipe account’s data. Treat it like a password.

Call the API from your server only — never embed the key in browser JavaScript, mobile apps, or public repositories.
Store it in an environment variable or a secrets manager, not in source code.
If a key is exposed, regenerate it from the API Integration page and update your servers with the new key.