Authentication

All Public API requests require a Bearer token. Channel credentials and warehouse codes are managed in the developer portal — never embed them in your client apps.

API keys {#api-keys}

Create keys under Developer Portal → API Keys after your app is approved.

Example request

curl https://api.hiobuy.com/v1/products/detail \
  -H "Authorization: Bearer hio_live_xxxxxxxx" \
  -H "Content-Type: application/json" \
  -d '{
    "channel": "1688",
    "product_id": "554456348334",
    "language": "en"
  }'

Channel authorization (prerequisite) {#channel-authorization}

An API key alone is not enough. Each app must complete channel authorization before calling product or order APIs for that marketplace.

See Portal authorization. If a channel is not authorized, calls return 401 CHANNEL_NOT_AUTHORIZED (Errors).

What you never send {#what-not-to-send}

• Taobao / 1688 / Weidian access tokens or refresh tokens
• Warehouse developer code (Gateway attaches it for fulfillment routes)
• Portal session JWT on Public API calls

Request tracing {#tracing}

Every response includes:

• x-request-id header — correlate with request_id in the JSON body
• Optional quota headers on billable routes — see Rate limits

Include x-request-id when contacting HIOBuy support.

Common auth errors {#auth-errors}