Skip to main content

​
API Key Authentication

All requests to the Upwell API must be authenticated using your API key, included in the Authorization header of each request.

​
Getting Your API Key

API keys are self-serve — you create them in the Upwell dashboard:
1

Log into your Upwell dashboard

Any member of your organization can create an API key.
2

Navigate to Account → API keys

If API keys isn’t visible in your navigation, it isn’t enabled for your organization yet — ask your Upwell administrator or support@upwell.com.
3

Click "Add API Key"

The key value is displayed once, at creation. Copy and store it securely — you can’t retrieve it again later, only revoke it and create a new one.
The API keys page under Account, with the Add API Key button above an empty list of keys

Account then API keys. Add API Key issues a key; the value is shown once, at creation.

API keys are sensitive credentials. Never share your API key or commit it to version control. If your key is compromised, create a new one immediately and revoke the old key from the same Account → API keys page.

​
Key scope

  • One key belongs to one Upwell organization (tenant) — the one it was created in. All data access through that key is scoped to that organization.
  • Integrating with more than one Upwell customer? There is no cross-tenant credential: you hold one API key per customer, each created inside that customer’s own dashboard.
  • Keys don’t expire. Rotation is manual: create a new key, switch your integration over, then revoke the old one.

​
Environments

  • Keys are environment-specific. Each environment is a separate deployment with its own data, so a key created in your production dashboard authenticates only against api.upwell.com.
  • Staging access is provisioned by Upwell, not self-serve — ask support@upwell.com or your Upwell contact to set up a staging organization and credentials for integration testing.
Staging can make real outbound deliveries. Separate data and API keys do not prevent invoices from reaching configured email recipients or customer portals. For an email-only test, verify the customer has only the intended email delivery method and check all recipients, including the default Upwell monitoring BCC. Current customer settings must be verified in staging before sending; they are not established by the API documentation.

​
Using Your API Key

Include your API key in the Authorization header of all API requests. The key is an opaque string — send it exactly as issued:
A Bearer scheme prefix is also accepted (case-insensitive), so HTTP clients and generated SDKs that default to it work unchanged:
Both forms are equivalent — use whichever your HTTP client produces naturally.

​
Example Requests