API Key

All requests to the Commerce Cloud API must be authenticated using an API key. The key is passed as a custom HTTP header on every request.

The X-Api-Key header

Include your API key in the request header:

X-Api-Key: your-api-key-here

Requests without a valid key — or with a missing header — will be rejected with a 401 Unauthorized response.

Examples

curl -X POST https://gateway.cc.danofficeit.com/orders/create \
  -H "X-Api-Key: your-api-key-here" \
  -H "Content-Type: application/json" \
  -d '{ "externalDocumentNumber": "PO-1234", ... }'

const response = await fetch('https://gateway.cc.danofficeit.com/orders/create', {
  method: 'POST',
  headers: {
    'X-Api-Key': 'your-api-key-here',
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({ externalDocumentNumber: 'PO-1234', /* ... */ }),
});

import httpx

response = httpx.post(
'https://gateway.cc.danofficeit.com/orders/create',
headers={
'X-Api-Key': 'your-api-key-here',
'Content-Type': 'application/json',
},
json={'externalDocumentNumber': 'PO-1234'},
)

using var client = new HttpClient();
client.DefaultRequestHeaders.Add("X-Api-Key", "your-api-key-here");

var response = await client.PostAsJsonAsync(
    "https://gateway.cc.danofficeit.com/orders/create",
    new { externalDocumentNumber = "PO-1234" }
);

Production and Test keys

We have multiple environments, hence you will also have multiple keys. Some keys will be for our production and some for the test environment.

To distinguish between the keys, we made a prefix on all keys.

• cc_live = Production
• cc_test = Test

This follows a pattern most big API vendors provide, which is also the reason for us adopting it. Here are two examples for your reference.

cc_live_b52896d2e19a4194a74ba19e26477b59

cc_test_af79f9fa80154cbe95b99188480a4a14

This way you always know what environment a key is for.

Configuring the API playground

The interactive API playground on each endpoint page sends requests through a proxy on your behalf. To authenticate, click Authorization at the top of any endpoint page and enter your API key — it will be included automatically in all test requests.

Getting an API key

API keys are issued per customer during onboarding and you might have multiple keys depending on your requirements. When a key is issued, you will receive an email from the platform with details and the key. If you do not have a key yet, contact your account manager or refer to the Onboarding page to get started.

Key Expiration

The default lifetime of an API key is 360 days. When the lifetime of a key is reached, we will rotate the key and provide it with a default value of 30 days.

An email will be sent to the integration responsible in your organization that the key has been rotated. The email contains the new key and instructions for when the key will stop working.

If you got any questions in regards to this or have a special requirement for the lifetime of keys, please reach out to our integration team. We will be happy to discuss your options.