Apidoor Authentication

generated: '2026-10-28'
method: searched
source:
- https://docs.apidoor.io/docs/send-requests
- https://docs.apidoor.io/docs/api-keys
- https://docs.apidoor.io/docs/projects-and-upstreams
- https://docs.apidoor.io/docs/access-controls
docs: https://docs.apidoor.io/docs/send-requests
schemes:
- name: ApiKeyHeader
  type: apiKey
  in: header
  header: X-API-Key
  description: Customers send the full Apidoor-issued key in the X-API-Key header to the project gateway hostname. Keys start
    with apdr_key_, are shown once, stored as a one-way hash, and cannot be retrieved, renamed, reassigned or rotated (revoke
    and replace).
  key_prefix: apdr_key_
- name: UpstreamProxySecret
  type: apiKey
  in: header
  header: x-apidoor-proxy-secret
  direction: gateway-to-upstream
  description: Apidoor adds the project verification secret to every forwarded request so the seller upstream can reject traffic
    that did not come through Apidoor. Cannot be recovered or rotated from the dashboard.
- name: WebhookSignature
  type: hmac
  header: apidoor-signature
  direction: apidoor-to-seller
  description: 'Limit webhooks are signed: apidoor-signature has the form t=timestamp,v1=hex_signature, an HMAC-SHA256 of
    timestamp.raw_body with a signing secret starting apdr_whsec_.'
note: No OAuth. The seller dashboard (app.apidoor.io) is a browser sign-in, not a documented API.