Authentication

Send the key in x-api-key

Put your key in the x-api-key header of every request:

curl -sS https://api.ravifurnitures.in/graphql \
  -H 'Content-Type: application/json' \
  -H 'x-api-key: YOUR_API_KEY' \
  -d '{"query":"{ warehouses { name } }"}'

• Header names are not case-sensitive, so X-Api-Key works too.
• Don’t send an Authorization header as well. When it carries a valid RaviFurnitures sign-in token, the API uses that and ignores your key.
• Call the API from your server. The key must never reach a browser, a mobile app or a retailer’s device.

Key format

A key is rfk_ followed by 43 characters from A–Z, a–z, 0–9, - and _. Staff can see only its first 8 characters in the admin portal, to tell keys apart.

RaviFurnitures stores only a SHA-256 hash of the key. Nobody can look it up or show it to you again.

A bad key looks like no key

The API never answers 401 for a bad key. A mistyped, unknown or revoked key is silently ignored, and the request runs as if it had no key at all. What you see depends on the query:

Query	With a bad or revoked key
orders, refunds, warehouses, lowStock, consignments, consignmentInvoices, retailerStatements, retailerPayments	Error Staff authentication required.
order(number:)	Error You do not have access to this order. when the order exists; null when no order has that number.
products, product	No error. You get only published products, and staff-only fields come back empty: stocks is [], costPrice is null, privateMetadata is []. The exception is products(filter: { status: … }), which answers Staff authentication required.

A valid key that lacks the permission gets Missing permission: MANAGE_ORDERS. (naming the permission the query needs) from the queries in the first row. order(number:) is different: any key without MANAGE_ORDERS, valid or not, gets You do not have access to this order. for an existing order.

Every one of these errors arrives in the errors array with extensions.code set to PERMISSION_DENIED, for example:

{
  "data": null,
  "errors": [
    {
      "message": "Staff authentication required.",
      "locations": [{ "line": 1, "column": 3 }],
      "path": ["warehouses"],
      "extensions": { "code": "PERMISSION_DENIED" }
    }
  ]
}

Catch a revoked key in a catalogue feed

Because products doesn’t fail, a feed whose key was revoked keeps running and quietly returns empty stock. Add a query that needs the permission, such as warehouses, to each run and stop when it returns Staff authentication required.

Store keys safely

• Keep the key in a secret manager or in your server’s protected configuration.
• Never put it in source control, front-end code, URLs, logs, tickets or screenshots.
• Use a separate key for each integration and each system, so you can revoke one without stopping the others.

Rotate a key

Keys don’t expire, and their permissions can’t be changed once created. To rotate a key, or to change its permissions:

1. Ask your RaviFurnitures contact for a new key with the permissions you need.
2. Deploy the new key and confirm it with one read query.
3. Ask your contact to revoke the old key (Revoke on the same admin page).

Revoking takes effect from the next request: the key is checked on every call. Ask for a revoke straight away if a key may have leaked, or when someone who had access to it leaves.

What a key cannot do

• A key acts with exactly the permissions it was given, and nothing else.
• It cannot stand in for a customer or retailer. Operations meant for them need their sign-in token, and answer a key with Authentication required.
• It has no expiry date and no IP address restriction.