Get your key
Sandbox keys are self-serve: create an account at developer.spinwheel.io, then find your key under Sandbox API Keys. It works against every sandbox service.
Production keys are not self-serve — contact your Spinwheel representative.
Keep the key server-side. This is a server-to-server API; it should never reach a browser or a mobile binary.
Send it
curl https://sandbox-api.spinwheel.io/v1/users?extUserId=partner-user-123 \
--header 'Authorization: Bearer YOUR_API_KEY' \
--header 'Content-Type: application/json'The literal Bearer prefix, including the space, is part of the header value. Sending the bare key returns a 401 — the most common first-call error against this API.
Keys are environment-specific: a sandbox key will not authenticate against api.spinwheel.io. Keep the base URL and the key together in configuration.
When it fails
| Cause | Status | Message |
|---|---|---|
| Missing, malformed or unknown key | 401 | Generic auth failure |
| Key deactivated | 401 | Authentication key is not active, please connect Spinwheel support |
| Endpoint not permitted for this key | 403 | Access denied |
Read status.messages[].desc — the HTTP status alone will not tell you which problem you have.
A 401 that appears suddenly on a working integration is usually a deactivated key rather than a code change. Check the message before debugging your request.
A key can be scoped to a subset of endpoints, so a 403 on a call that works elsewhere is normally scope, not a malformed request.
Some endpoints also require Spinwheel's secure hosts — see API Environments.