Authentication

Every request to the Propelus API must be authenticated with two header credentials. There are no unauthenticated endpoints.

Required headers

Send both headers on every request:

curl https://api.demo.propelus.com/v2/professions \
  -H "x-api-key: $PROPELUS_API_KEY" \
  -H "x-client-id: $PROPELUS_CLIENT_ID"

Both are required together. A request missing either header, or sending an invalid value, is rejected before any processing happens.

Getting credentials

TBD, API team to confirm. Document how customers obtain their x-api-key and x-client-id (self-serve portal vs. provisioned by Propelus), and whether credentials are issued per environment.

Until that process is documented here, contact support@propelus.com to request or troubleshoot credentials.

Demo vs. production keys

TBD, API team to confirm whether the same credentials work in both Demo and Production, or whether each environment issues its own key pair.

See Environments for the base URLs each environment uses.

Authentication failures

Failed authentication returns the standard error envelope:

{
  "status": 401,
  "detail": "Invalid API credentials.",
  "code": "invalid_credentials"
}

• A 401 or 403 means one or both headers are missing, malformed, or not authorized for the resource. Verify you are sending x-api-key and x-client-id with the values for the environment you're calling.
• The code field (invalid_credentials) is stable and safe to branch on; the detail message is human-readable and may change.

See the full list of error codes in the Errors reference.

Keeping credentials safe

• Never ship keys to a browser or mobile client. Call the Propelus API only from your backend; a key embedded in client-side code is exposed to anyone who loads the page.
• Store keys in a secret manager or environment variables, not in source control.
• Rotate a key immediately if it is exposed. Contact support@propelus.com to rotate credentials.