Skip to main content
Interstellas requests are authenticated with three headers that work together on every request. Understanding what each one is prevents the most common integration errors.

​
Credential types

​
API key

The API key is the public identifier for your API client. It’s safe to reference in logs and internal tooling, but should still be treated as sensitive since it’s one half of your credential pair.
  • How to get it: Dashboard → Settings → API Keys.
  • Where to send it: x-api-key: <key> header.
  • Format: stl_ followed by 32 hexadecimal characters.

​
API secret

The API secret is the private credential paired with your API key. Its prefix determines whether a request is treated as sandbox or production traffic.
  • How to get it: Dashboard → Settings → API Keys. Shown once, at creation or regeneration time — it cannot be retrieved afterward.
  • Where to send it: x-api-secret: <secret> header.
  • Format: stl_test_ or stl_live_ followed by 64 hexadecimal characters.

​
Business ID

The business ID scopes each request to a specific registered business under your account. A single client account can own multiple businesses, and most endpoints require you to specify which business you are operating on.

​
Using them together

If x-api-key or x-api-secret is missing or invalid, the request fails with 401 Unauthorized. Do not additionally send an Authorization: Bearer header — that combination is rejected.

​
Sandbox vs. production

Use sandbox credentials (stl_test_...) against the sandbox base URL during development. Use production credentials (stl_live_...) only against the production base URL. Sandbox and production credentials are fully isolated — separate rate-limit budgets, separate data — and can’t be mixed.

​
Rotating and revoking keys

Generate a new secret from Settings → API Keys in the dashboard — the new value is shown once, so store it immediately. Update your application’s environment variable before revoking the old key to avoid downtime. Revocation takes effect within about 60 seconds. See Authentication for scopes, rate limits, and the full error reference.