Authentication
Send two headers on every request. X-API-Key works like a username and X-API-Secret like a password. Create the pair on the API keys page of the dashboard; the secret is shown only once and is not stored in plain text.
cURL
curl https://ulawk.com/api/v1/sirketler/ \
-H "X-API-Key: ulk_DENEME_ANAHTARINIZ" \
-H "X-API-Secret: ulsk_DENEME_GIZLI_ANAHTARINIZ"Key types
| Type | What it sees |
|---|---|
| Live | Only the companies you follow. Adding uses your allowance. |
| Sandbox | Only made-up DENEME-… companies; never touches live data, your plan or the registry. Responses carry X-Ulawk-Ortam: deneme. (Sandbox) |
Rules
- A wrong or missing secret returns
401 yetkisiz. - Requests that create, change, delete or test webhooks work with an API key only; browser sessions are refused (
403 anahtar_gerekli). - MCP takes the same pair as
Authorization: Bearer KEY:SECRET; MCP does not accept sandbox keys (MCP). - Older keys created before secrets existed keep working on their own; use a pair for new integrations.
- Never put keys in browser code, mobile apps or public repositories; call from your server.