Base URL & authentication

Everything you need before calling your first endpoint: where the API lives and how to prove who you are.

Base URL

All API requests are made to:

text

https://api.plugie.ai

Endpoints are versioned under a path prefix (for example /v1), so a full URL looks like https://api.plugie.ai/v1/search. Always use HTTPS — plain HTTP requests are rejected.

Authentication

Plugie authenticates programmatic requests with an API key. A key belongs to a seller account and carries that seller's permissions.

Get a key

In the seller app, open API keys and choose Create key. Give it a name so you remember where it's used. The full secret is shown once, at creation — copy it immediately and store it somewhere safe. If you lose it, revoke the key and create a new one.

Every key looks like plg_…. Only a hash of the key is stored on our side, so we can't recover the plaintext for you later.

Authenticate a request

Send your key as a Bearer token in the Authorization header:

curl

curl https://api.plugie.ai/v1/search \
  -H "Authorization: Bearer plg_your_api_key" \
  -H "Content-Type: application/json" \
  -d '{ "query": "black office chair under €200" }'

Keep keys secret. Treat an API key like a password: never commit it to a repo or ship it in client-side/browser code where users could read it. Call Plugie from your server, or a trusted backend, and keep the key in an environment variable.

Revoking a key

Revoke a key any time from the seller app. Revocation is immediate — the next request using that key is rejected. Revoking one key never affects your other keys.

Errors

Authentication problems return a 401 Unauthorized with a JSON body describing what went wrong:

json

{
  "error": {
    "code": "unauthorized",
    "message": "Invalid or revoked API key."
  }
}

Common causes: a missing Authorization header, a malformed value (it must be Bearer plg_…), or a key that has been revoked.

Ready to make a call? Continue to the Search endpoint.