API Authentication

API Keys

Distribusion uses API keys to allow access to the platform’s inventory and enable the performance of successful API requests. The API Keys follow alpha-numeric format, such as ZW8FXhnBl53yTkrMvoqLp4Xq7mf9nEBGsxpTWrid, and must be passed as an Api-Key header within each request, as shown in the example below:

curl  'https://api.demo.distribusion.com/retailers/v4/stations' \ 
--header 'Api-Key: ZW8FXhnBl53yTkrMvoqLp4Xq7mf9nEBGsxpTWrid'curl  'https://api.demo.distribusion.com/retailers/v4/stations' \ 
--header 'Api-Key: ZW8FXhnBl53yTkrMvoqLp4Xq7mf9nEBGsxpTWrid'

Rotating an API key

A new key can be issued before the old one is retired, and both run in parallel for as long as needed. Keys are validated independently and each carries its own expiry, so a credential can be rolled across a fleet at the retailer's own pace and the previous key left to lapse once traffic has moved. Changes take effect within seconds — no maintenance window, no coordinated cutover, no dropped requests.

Request a rotation through the account manager.

Environments

Distribusion has two external environments, which each require their own API key:

• Production environment: https://api.distribusion.com
• Demo environment: https://api.demo.distribusion.com

Retailer Partner Number

For some of the endpoints you call, besides using the API credentials, you should also include your retailer_partner_number. We often refer to this as RPN. This 6-digit number is always shared alongside your API credentials & must be used in tandem with the same credentials used for the endpoint.

Additional authentication methods

Two further controls can be enabled on an account, either alongside the API key or in place of relying on it alone.

IP allowlisting. An account can be restricted to a set of source addresses or CIDR ranges. The allowlist is an additional requirement layered on top of the API key, so a leaked key alone is not enough to reach the account.

Mutual TLS. A client certificate can be presented and verified during the TLS handshake. Because the certificate is bound to the connection rather than carried in a header, it cannot be replayed or forged by an intermediary — the strongest option available, and one Distribusion can make mandatory for an account.

Both are configured per account. Requests go through the account manager.