Developer docs contents
Keys and authentication
Create a key, send it with every request, and keep it out of anywhere it could leak.
Every request under /v1 sends an API key as a bearer token. Keys are created on the POS API page of your dashboard by a company owner or admin, and shown once.
curl https://api.eslana.com/v1/ping \
-H 'Authorization: Bearer esl_test_…'Live and test keys
| Prefix | What it does |
|---|---|
esl_live_ | Changes the prices on your shelves. |
esl_test_ | Authenticated, rate-limited, validated and logged exactly like a live key, but writes nothing. Batch results say what would have happened. |
Build and test your integration with a test key, then swap in a live key. Nothing else changes.
What a key can reach
A key reaches every store of your company. Address a store by its eslana id or by the POS store code you set for it on the POS API page, so your till can use the location code it already has.
Keeping keys safe
- Keep keys on your server or in your POS backend. Never put one in a web page, a mobile app or a public repository.
- Give each till system or integration its own key, so one can be revoked without stopping the others.
- Revoke a key the moment you suspect it has leaked. Revocation reaches every server within 30 seconds.
- We store only a fingerprint of each key. If you lose one, revoke it and create another.