Authentication

All API requests require authentication via an API key. Keys are scoped to your account and can be managed from your dashboard.

Creating an API Key

From the Dashboard

Go to Settings → API Keys
Click Create New Key
Give it a name (e.g., “Production”, “Development”)
Copy the key immediately — it won’t be shown again

Via API

# Create a key (requires session auth)
curl -X POST https://garmint.app/api/v1/keys \
  -H "Content-Type: application/json" \
  -d '{ "name": "My Integration" }'

Response:

{
  "key": "gm_live_a1b2c3d4e5f6...",
  "metadata": {
    "id": "key_xxx",
    "name": "My Integration",
    "lastFour": "f6g7",
    "createdAt": "2024-12-19T12:00:00Z"
  },
  "warning": "Save this key now - it will not be shown again!"
}

Using Your API Key

Include your API key in the Authorization header:

curl https://garmint.app/api/v1/garments \
  -H "Authorization: Bearer gm_live_xxx"

Never expose your API key in client-side code. Always make API calls from your server.

Key Format

Keys follow this format:

gm_live_<64 character hex string>

gm_ — Garmint prefix
live_ — Environment (live for production)
<hex> — Unique identifier

Key Security Best Practices

Store keys securely

Use environment variables or a secrets manager. Never commit keys to git.

# .env.local (gitignored)
GARMINT_API_KEY=gm_live_xxx

Use separate keys per environment

Create different keys for development, staging, and production. This lets you rotate keys independently.

Set expiration dates

When creating keys, consider setting an expiration:

{ "name": "Temp Integration", "expiresInDays": 30 }

Revoke compromised keys immediately

If a key is exposed, revoke it from the dashboard or via API:

curl -X DELETE https://garmint.app/api/v1/keys/key_xxx

Managing Keys

List All Keys

curl https://garmint.app/api/v1/keys \
  -H "Cookie: <session>"

Revoke a Key

# Revoke (soft delete - key stops working)
curl -X DELETE https://garmint.app/api/v1/keys/key_xxx

# Permanent delete
curl -X DELETE "https://garmint.app/api/v1/keys/key_xxx?permanent=true"

Error Responses

Invalid or Missing Key

{
  "error": {
    "code": "unauthorized",
    "message": "Missing or invalid API key. Provide a valid key via Authorization header."
  }
}

Status: 401 Unauthorized

Revoked Key

{
  "error": {
    "code": "unauthorized",
    "message": "Missing or invalid API key. Provide a valid key via Authorization header.",
    "details": { "reason": "API key has been revoked" }
  }
}

Status: 401 Unauthorized

Expired Key

{
  "error": {
    "code": "unauthorized",
    "message": "Missing or invalid API key. Provide a valid key via Authorization header.",
    "details": { "reason": "API key has expired" }
  }
}

Status: 401 Unauthorized

Getting Started

Endpoints

Authentication

Authentication

Creating an API Key

From the Dashboard

Via API

Using Your API Key

Key Format

Key Security Best Practices

Managing Keys

List All Keys

Revoke a Key

Error Responses

Invalid or Missing Key

Revoked Key

Expired Key

​Authentication

​Creating an API Key

​From the Dashboard

​Via API

​Using Your API Key

​Key Format

​Key Security Best Practices

​Managing Keys

​List All Keys

​Revoke a Key

​Error Responses

​Invalid or Missing Key

​Revoked Key

​Expired Key

Authentication

Creating an API Key

From the Dashboard

Via API

Using Your API Key

Key Format

Key Security Best Practices

Managing Keys

List All Keys

Revoke a Key

Error Responses

Invalid or Missing Key

Revoked Key

Expired Key