Send your API key
Every business endpoint requires an API key in the Authorization header:
curl "$AKARIQ_BASE_URL/balance" \
-H "Authorization: Bearer $AKARIQ_API_KEY"The documentation and OpenAPI specification are public. API keys are issued by Akariq; OAuth and consumer account login are not part of the reseller API.
Permissions
| Scope | Allows |
|---|---|
catalog:read | Read countries, regions and plans |
balance:read | Read balance and transaction history |
balance:write | Create account-funding checkout links |
orders:write | Place reseller orders |
orders:read | Read your orders and their progress |
esims:install | Retrieve installation details for your purchased eSIMs |
Ask for the permissions your integration needs.
Credential lifecycle
Keys have an expiry date. Arrange a replacement before expiry, deploy it securely, verify it works, then ask Akariq to revoke the old key. Revoked or expired keys and suspended accounts are rejected. Sandbox keys cannot authenticate against production, and vice versa.
Store keys in server-side secrets or environment variables. Never embed them in browser JavaScript, mobile application bundles, public repositories, analytics events or support screenshots. The same applies to webhook signing secrets.
Account boundaries
A key can access only the orders and eSIMs owned by its partner account. An inaccessible order may return 404 rather than reveal that another account owns it. Never use another customer’s order ID to infer access.
401 means credentials were not accepted. 403 means the authenticated key lacks the required permission or the operation is unavailable for that account type. See Errors & retries.