Skip to main content

Reseller API Authentication

The Reseller API uses Admin API Key authentication for reseller and partner operations.

Overview​

The Reseller API is designed for resellers and partners who manage multiple customers and their handbooks. All requests require a valid admin API key.

Authentication Method​

Admin API Key - Pass in the X-Api-Token header

Using API Token​

curl -X POST https://handbooks.io/api/graphql-reseller \
  -H "Content-Type: application/json" \
  -H "X-Api-Token: your_api_token_here" \
  -d '{"query": "{ handbookCustomers { customers { userId email name } total } }"}'

JavaScript Example​

const response = await fetch('https://handbooks.io/api/graphql-reseller', {
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'X-Api-Token': 'your_api_token_here',
  },
  body: JSON.stringify({
    query: `
      query {
        handbookCustomers {
          customers {
            userId
            email
            name
          }
          total
        }
      }
    `,
  }),
});

Getting Your API Key​

Contact [email protected] to obtain your admin API key for reseller operations.

Token Expiration​

  • API Tokens: Do not expire (unless revoked by support)
  • Tokens can be rotated or revoked by contacting support

Security Best Practices​

  1. Never commit tokens to version control
  2. Use environment variables to store tokens
  3. Rotate tokens regularly for security
  4. Use HTTPS for all API requests
  5. Limit token access - Only share API keys with authorized personnel
  6. Monitor token usage - Report any suspicious activity immediately

Error Responses​

Invalid Token​

{
  "errors": [
    {
      "message": "Invalid token",
      "extensions": {
        "code": "UNAUTHENTICATED"
      }
    }
  ]
}

Missing Token​

{
  "errors": [
    {
      "message": "Unauthorized: Token required",
      "extensions": {
        "code": "UNAUTHENTICATED"
      }
    }
  ]
}