Every request to the GIFQ API is authenticated with an API token sent in the X-Api-Token header. This article covers how tokens are issued, how environments are separated, and how to rotate a key.
How authentication works
Each request carries your token in the X-Api-Token header. The token identifies your company and grants full access to its balances and orders — treat it like a password. Tokens are stored encrypted at rest and can be active or inactive.
If a request arrives without an X-Api-Token header, it falls back to IP-based throttling under the same 10 requests-per-second limit. Authenticate every request from your application.
Sandbox and production are separate
Sandbox and production are independent deployments — different subdomains and different databases:
Sandbox —
https://api-sandbox.gifq.comProduction —
https://api.gifq.com
Because they're separate environments, tokens are not interchangeable: a production token will not work against sandbox, and vice versa. You receive a distinct token for each environment. The same integration code runs against both — you switch the base URL and the token, nothing else.
Obtaining and rotating tokens
API tokens are issued by your GIFQ account manager — there is no self-serve key generation in the dashboard today. You'll receive separate tokens for sandbox and production.
To rotate a token:
Request a new token from your account manager — they issue a new active token.
Swap the new token into your application's configuration.
Confirm traffic is flowing on the new token, then ask your account manager to deactivate the old one.
This zero-downtime swap (new token live before the old one is retired) is the recommended rotation pattern, including if you suspect a token has been exposed.
Best practices
Never hard-code tokens. Load them from environment variables or a secrets manager.
Keep sandbox and production credentials clearly separated in your config so a test never runs against live balances.
Authenticate every request — don't rely on the unauthenticated IP fallback.