Authentication - Bukki Developer

Every public API request requires a Bukki API key in the X-API-Key header.

curl "https://api.getbukki.com/v1/items" \
  -H "X-API-Key: $BUKKI_API_KEY"

Workspace binding

An API key belongs to exactly one workspace. Bukki derives the workspace from the authenticated credential and rejects attempts to supply a different workspace through query or body parameters.

Scope enforcement

Keys use least-privilege scopes:

Scope	Access
`contacts:read`	Read active customers and suppliers
`items:read`	Read active products and services

A valid key without the required route scope receives 403 FORBIDDEN.

Secret handling

Bukki displays the full credential once and stores only a one-way hash. Treat the key like a password:

Store it in a server-side secret manager
Redact it from logs and error reports
Use separate keys for separate integrations
Revoke it immediately if it may have been exposed