Autenticación

Integraciones externas de partner

Use the X-API-Key header for partner external endpoints such as /api/partner/*.

X-API-Key: sk_live_your_api_key

Auth is API key only. There is no X-API-Secret / x-api-secret requirement on the live guard.

SSOT de credenciales

Store	Contents
partner_api_keys	API keys used for auth (mint via regenerate / create)
partner_webhooks.secret	Preferred webhook HMAC secret
seller_profiles.api_configuration	Metadata + apiEnabled only (no plaintext apiKey / apiSecret)

enableApi toggles access flags / key activation. It does not mint a new key — remint is Regenerate only (once-reveal). Regenerate returns { apiKey } only — there is no functional apiSecret.

Admin/settings webhookUrl updates the latest active partner_webhooks.url (no secret remint). Clearing deactivates active rows. First webhook rows come from approve/portal create (once-reveal).

Example

curl -X GET "https://service-gateway.loscenotes.com/api/partner/cenotes" \
  -H "X-API-Key: sk_live_your_api_key" \
  -H "Content-Type: application/json"

Otros modelos de auth en la plataforma

• Partner portal and management endpoints use JWT
• Some shared public endpoints do not require API key auth
• Some operational endpoints, such as on-site checkout confirmation, require role-based authenticated access

Sandbox y WebSocket

• El sandbox del partner está live: puedes crear claves sk_test_, generar y reiniciar datos de sandbox desde el portal. Los datos usan el schema aislado partners_sandbox (no tablas de producción).
• sk_test_ no puede llamar /api/partner/* (ni otras rutas partner de producción). El guard solo permite claves sandbox en /api/partner-sandbox/* y /api/partner/webhooks/simulator/*. En cualquier otro sitio → Forbidden error.partner.sandbox_key_not_allowed_on_production_api. Usa sk_live_ para todos los ejemplos de /api/partner/*.
• El WebSocket realtime del partner no forma parte del runtime actual del módulo Partners.

Forma de error

Current API errors are returned in the enhanced global format:

{
  "success": false,
  "message": "validation.invalid_data",
  "error": "Bad Request",
  "statusCode": 400,
  "timestamp": "2026-03-10T18:00:00.000Z",
  "path": "/api/partner/cenotes"
}