Reference

Authentication

The Purelist API uses bearer tokens. Every request must include an Authorization header with your API key.

API keys

Your secret key is issued in the dashboard and looks like sk_live_…. Treat it like a password — never expose it in client-side code. Pass it as a bearer token on every request.

Authorization header

curl https://api.purelist.io/api/verify \
  -H "Authorization: Bearer sk_live_..." \
  -H "Content-Type: application/json" \
  -d '{"email":"name@example.com"}'

Errors

Missing or invalid keys return 401 Unauthorized.

{
  "error": {
    "code": "invalid_api_key",
    "message": "The provided API key is invalid or revoked."
  }
}

Rotating keys

Rotate from Dashboard → API & settings. Rotating immediately invalidates the previous key, so update your integration before you rotate.