Authentication

Product API requests use a SUMUN API key in the HTTP Authorization header.

Authorization: Bearer sumun_live_<your-secret>

Send the key only over HTTPS and only from a trusted backend or serverless environment. Do not place it in a URL, query string, frontend bundle, or public log.

The API validates that the key is active, unexpired, and authorized for the endpoint scope. Missing or invalid credentials return 401; a valid key without the required scope returns 403.