API Keys & Account Scope

TL;DR

Your API key identifies your workspace and scopes every request to it — you don't pass a tenant id. The optional X-Account-Id header pins a specific connected account when you have more than one for a provider.

There are two levels of scope in the Repull API: the workspace (who you are) and the connected account (which provider connection a request touches). Almost everything you do is scoped by your key alone.

The API key is your workspace

Every request authenticates with your key in the Authorization header (or x-api-key). The key resolves to exactly one workspace, and the API automatically scopes all reads and writes to it. You never pass a customer or tenant id — attempting to read a property, reservation, or connection that isn't yours returns 404 not_found, never another tenant's data.

curl https://api.repull.dev/v1/properties \
  -H "Authorization: Bearer sk_live_YOUR_KEY"

Two things to know about the key itself:

Environment prefix. sk_test_ keys are for building and testing; sk_live_ keys are for production. See Sandbox & Testing.
Scoped keys. A market-data-only key is restricted to /v1/markets/* and returns 403 forbidden elsewhere.

Connected-account scope

When a request needs a specific provider connection — reading a channel's listings, pushing pricing or availability — the API resolves the connection for your workspace automatically. For a single connection per provider (the common case) there is nothing extra to send.

The optional X-Account-Id header lets you name a specific connection explicitly. When you send it, it must reference a connection your workspace owns, or the whole request returns 404 not_found. Get the account id from GET /v1/connect — each connection in the response has an id field, and that id is exactly what X-Account-Id resolves against.

# 1. List your connected accounts and copy the id you want
curl https://api.repull.dev/v1/connect \
  -H "Authorization: Bearer sk_live_YOUR_KEY"
# → { "data": [ { "id": 55, "provider": "airbnb", "status": "active", ... } ] }

# 2. Pin that account for a request via X-Account-Id
curl https://api.repull.dev/v1/channels/airbnb/listings \
  -H "Authorization: Bearer sk_live_YOUR_KEY" \
  -H "X-Account-Id: 55"

Optional today, forward-looking

X-Account-Id is optional on every endpoint. It exists for workspaces that connect more than one account for the same provider; today the API already resolves your connection from the key, so single-account integrations can omit it entirely. Send it when you want to be explicit about which connection a request targets.

By operation

Area	Key alone	`X-Account-Id`
Connect setup (`POST /v1/connect/{provider}`), key & webhook management	Sufficient	Not used
Inventory (`/v1/properties`, `/v1/listings`) & reservations	Sufficient	Optional — pin a connection
Per-channel reads & writes (pricing, availability, content)	Sufficient	Optional — pin a connection
Market data (`/v1/markets/*`)	Sufficient	Not used

Previous← Authentication NextIDs & External IDs →