API Credentials

To access the Drop Cowboy API, you need your API Credentials.

To access the Drop Cowboy API, you must first complete the Know Your Customer (KYC) process. This includes verifying your identity and registering your brand(s) in the Drop Cowboy Trust Center.

Once approved, you’ll receive a Team ID and Secret Key used to authenticate requests to the API.

---

Getting Your Credentials

1. Log in to your Drop Cowboy account.

2. Navigate to My Account → API.

3. Locate your:

   1. team_id

   2. secret

⚠️ Keep these credentials secure. Do not share them publicly or include them in client-side code (such as browser JavaScript).

If you're working with a developer or a third-party integration, share these keys only with trusted partners.

---

Using Credentials in the API

When calling the Drop Cowboy API directly, include your credentials in each request:

• For HTTP operations → include in the request headers

Example (GET request)

curl -X GET "https://api.dropcowboy.com/v1/brand" \
  -H "x-team-id: YOUR_TEAM_ID" \
  -H "x-secret: YOUR_SECRET"

---

Using Credentials with the Drop Cowboy SDK

The Drop Cowboy SDK allows you to authenticate globally or per instance.

Option 1 — Global Configuration

Create a config file at ~/.dropcowboyrc:

{
  "teamId": "your-team-id",
  "secret": "your-secret",
  "baseUrl": "https://api.dropcowboy.com/v1"
}

baseUrl is optional — it defaults to https://api.dropcowboy.com/v1.

Once created, any SDK instance you initialize will automatically use these credentials.

Option 2 — Per-instance Configuration

You can also pass credentials directly when initializing the client.

import { DropCowboy } from "dropcowboy";

const dropcowboy = new DropCowboy({
  teamId: "your-team-id",
  secret: "your-secret",
});

// Example: fetch all brands
const brands = await dropcowboy.listBrands();
console.log(brands);

---

Best Practices

• Store your credentials securely (e.g., environment variables or secrets manager).

• Never commit your keys to version control (like GitHub).

• Rotate keys periodically for better security.

💡 Tip: If you receive an “Unauthorized” or “Missing Credentials” error, double-check your x-team-id and x-secret values or verify that your API access has been approved in the Trust Center.