Authentication
All API requests are authenticated with an API key in the x-api-key header:
curl https://api.tryslatehq.com/customers \
-H "x-api-key: your_private_api_key" \
-H "Content-Type: application/json"
You can create and revoke API keys in the Developers section of the dashboard.
⚠️ Never expose your private API key in client-side code. Anything that runs in the browser must use a user session token instead — minted server-side per customer.
Base URLs
| Environment | API | Components script |
|---|---|---|
| Live | https://api.tryslatehq.com |
https://components.tryslatehq.com/slate.esm.js |
| Sandbox | https://api-sandbox.tryslatehq.com |
same script, with env="sandbox" on the component |
The sandbox is fully isolated: keys, webhooks, branding and data do not carry over to live. Embedded components take an env attribute ("sandbox" or "live") that selects which environment they talk to.
API key types
| Type | Use |
|---|---|
| Private | Server-side API calls. Full access to your organization's data. Keep it secret. |
| Public | Restricted client-side use where a public identifier is required. |
Rate limiting
Requests are rate limited per organization. When you exceed the limit the API responds with 429 Too Many Requests — back off and retry with exponential delay. Contact us if your integration needs a higher sustained throughput.
Errors
Errors are returned as JSON with an HTTP status, a machine-readable code and a human-readable message:
{
"code": "INVALID_STATE",
"status": 400,
"message": "Credit line is suspended, transactions cannot be logged"
}
Common codes:
| HTTP | Code | Meaning |
|---|---|---|
| 400 | BAD_REQUEST |
The input failed validation — the message says what's wrong |
| 400 | INVALID_STATE |
The request is valid but the object's current state doesn't allow it (e.g. recording a purchase on a suspended credit line) |
| 401 | UNAUTHORIZED |
Missing or invalid API key |
| 403 | FORBIDDEN |
The object exists but doesn't belong to your organization |
| 404 | NOT_FOUND |
The object doesn't exist |
| 409 | CONFLICT |
The resource already exists (e.g. a credit line for that application) |
| 429 | RATE_LIMITED |
Too many requests — retry with backoff |
| 500 | INTERNAL_SERVER_ERROR |
Something failed on our side — safe to retry; contact us if it persists |