Authentication

All API requests require authentication via an API key. Keys are passed in the Authorization header.

Getting an API Key

1. Create an account at pulls.app
2. Navigate to Settings → API Keys
3. Click Create API Key
4. Copy your key immediately - it won’t be shown again

Keep your key secret

API keys grant access to your account. Never commit keys to source control or expose them in client-side code.

Using Your API Key

Include the key in the Authorization header with a Bearer prefix:

cURL

curl -H "Authorization: Bearer pk_live_abc123..." \
  https://api.pulls.app/v1/cards

TypeScript

import { PullsAPI } from '@pulls/sdk'

const pulls = new PullsAPI({
  apiKey: process.env.PULLS_API_KEY
})

const cards = await pulls.cards.list()

Python

import os
from pulls import PullsAPI

pulls = PullsAPI(api_key=os.environ["PULLS_API_KEY"])
cards = pulls.cards.list()

Key Types

Type	Prefix	Use Case
Live	pk_live_	Production applications
Test	pk_test_	Development and testing

Test keys have the same rate limits as your plan but don’t affect usage quotas.

Key Permissions

API keys have full read access to all public endpoints. Write operations (creating listings, managing collections) require additional scopes.

Scope	Description
read	Default. Access cards, sets, prices.
collections:write	Manage user collections
marketplace:write	Create/manage listings

Rotating Keys

To rotate a key:

1. Create a new key
2. Update your applications
3. Delete the old key

Keys can be deleted at any time from your dashboard.

Error Responses

Invalid or missing authentication returns a 401 Unauthorized:

{
  "_tag": "Unauthorized",
  "message": "Invalid or missing API key"
}

Expired or revoked keys also return 401.