Authentifizierung
Send your API key on every metered /api/v1/... request.
Preferred: X-API-Schlüssel
curl -sS \
-H "X-API-Key: $WH_API_KEY" \
"{origin}/api/v1/credits"
Also accepted
| Verfahren | Beispiel |
|---|---|
| Inhaber | Authorization: Bearer $WH_API_KEY |
| Query | ?api_key=$WH_API_KEY (avoid in logs/URLs when possible) |
First non-empty value wins: X-API-Schlüssel → Bearer → api_key.
Nr.
The key must belong to an account with Basic plan or higher. Otherwise: HTTP 403 — WinningHunter Basic plan or higher required.
Manage keys on /api. Copy the plaintext key on first create or regenerate — later visits show a masked value only. Regeneration is immediate; the old key stops working.
Session vs API key
| Prefix | Autor | Use for |
|---|---|---|
/api/v1/... |
API key or logged-in dashboard session (both metered) | Integrations — prefer API key |
/api/tiktok-shop/*, /api/brands/*, /api/magic-ai, … (no v1) |
Browser session | Legacy dashboard paths — prefer /api/v1/... |
Un-versioned aliases exist for some routes (/api/adlibrary, /api/store-tracker, /api/store-explorer). Prefer /api/v1/....
Verify
curl -i -H "X-API-Key: $WH_API_KEY" "{origin}/api/v1/credits"
A 200 with a Im Abspann object means the key and plan are valid. See Fehler for other statuses.