Skip to main content

​
API key (brand-owned)

Brands generate a key on Account Portal → Settings → Integrations. The plaintext key is shown once. Branduo stores a hash only. Send the key on every request:
Do not put the key in the query string. Keys with the wrong prefix for the host are rejected.

​
Optional platform attribution

Tech platforms should also send:
X-Platform-Id is the catalog Platform.Id as a Guid string (type: string, format: uuid). It is not a Lookup TypeId and not an integer. The former TEST int 4 for Redo is void. Public example (Redo): e38849db-d0bf-494b-abe9-6bf5f833a34e. On the first valid call with a known Active Platform Guid, Branduo upserts a PlatformCompany link for that brand. Omitting X-Platform-Id is allowed (MCP-shaped callers). Header names stay X-Api-Key, Authorization: Bearer, and X-Platform-Id.

​
OAuth (optional)

OpenAPI also supports OAuth: short-lived access token (~1 hour) plus long-lived refresh (~5 years). Send:
Endpoints on the OpenAPI host:
  • GET /v1/oauth/authorize
  • POST /v1/oauth/token
See Swagger on the OpenAPI host for request/response shapes.