Developer documentation
Virtual try-on API authentication
TryRobe Business API requests use a merchant license key. Treat this key like a production password: keep it in encrypted server configuration, restrict who can access it, rotate it when needed, and never send it to analytics or logs.
Bearer authentication
Provide the key in the Authorization request header from a merchant backend.
Authorization: Bearer tr_live_REPLACE_WITH_YOUR_KEYKey storage rules
Store the key in a secrets manager or protected environment variable.
- Never commit it to Git
- Never embed it in storefront JavaScript
- Never include it in a mobile app
- Redact Authorization headers from logs
- Rotate immediately after suspected exposure
Workspace boundary
A valid key is scoped to its Business company. Requests are rejected for inactive, unverified, or non-Business accounts.
Frequently asked questions
Can I share one key across unrelated merchants?
No. Use the correct verified Business workspace for each merchant so credits, logs, and operational ownership remain isolated.
Can TryRobe show my raw key again?
The dashboard supports controlled reveal and rotation for authorized workspace roles; keep access tightly limited.