Authentication

All API requests are authenticated with a secret API key sent as a Bearer token.

API keys

• zap_live_... — live keys for production traffic
• zap_test_... — test keys for development

Keys are generated in your dashboard and displayed in full exactly once. We store only a SHA-256 hash — if you lose a key, revoke it and create a new one.

Sending the key

Include your key in the Authorization header on every request:

Authorization: Bearer zap_live_xxxxxxxxxxxxxxxxxxxx

Alternate header

If Bearer auth is inconvenient, send the key in the X-Zapinner-Key header instead. For backwards compatibility the legacy X-Zapiit-Key header is still accepted, so existing integrations keep working without changes.

Authentication errors

Missing, malformed, or revoked keys return 401 with a sanitized error body:

{
  "error": {
    "code": "invalid_api_key",
    "message": "Invalid API key.",
    "request_id": "req_9f8e7d"
  }
}

RapidAPI subscribers

RapidAPI subscribers use their RapidAPI credentials only. A Zapinner API key is not required, and there is no need to sign up on this site. Your RapidAPI subscription is your credential: RapidAPI attaches the required headers automatically, and Zapinner provisions your account on the first authenticated request, mapping your RapidAPI plan to the matching Zapinner tier.

Integration check

If subscriber requests are unexpectedly rejected, call the public diagnostics endpoint — from the RapidAPI playground to test the proxied path, or directly to test your own setup. It reports how the request was recognized without exposing any secret:

curl https://www.zapinner.com/api/v1/rapidapi/diagnostics

• recognized — the request was accepted as marketplace traffic; the subscriber is authenticated and auto-provisioned. Nothing more to do.
• secret_mismatch — a proxy secret was received but did not match. Copy the Secret Header value from your RapidAPI listing's Security settings into the RAPIDAPI_PROXY_SECRET environment variable and redeploy.
• not_forwarded — no proxy-secret header was present. Expected for direct calls; if it happens through RapidAPI, your listing is not forwarding the secret to the Zapinner base URL.
• server_not_configured — RAPIDAPI_PROXY_SECRET is not set on the deployment.