API Authentication

Get an API key

Sign in at /dashboard, click Create API key, give it a label (e.g. "production-pos") and copy the resulting csm_live_xxxxxxxx token. Keys are shown once — store them in your secret manager.

Send the header

curl https://collectorstashmarket.com/api/cards/search?q=charizard \
  -H "Authorization: Bearer csm_live_xxxxxxxxxxxxxxxx"

Tier-based access

Free tier blocks card-recognition and is rate-limited at 60 req/min. Starter, Pro, Business and Unlimited tiers unlock more endpoints, higher quotas and recognition access. See pricing.

Security best practices

• Never embed keys in client-side code — proxy through your own backend.
• Rotate keys quarterly via the dashboard.
• Use a separate key per environment (dev / staging / production).
• Revoke immediately on suspected compromise; old key 401s within 60 s.