API keys
Use a personal API key to call the REST API from your scripts.
Create and revoke a key
Sign in to NinjaBuy and open Account → Referrals → API keys to create, list and revoke named keys. The full key starts with nb_ and is shown only once. Use Copy key to save it securely before closing the message.
A key never expires unless you pick a lifetime when you create it: 30 days, 90 days or 1 year. Revocation or the end of that lifetime applies to the next request, and an expired key disappears from the list.
Only a SHA-256 hash of the key is stored.
Use a key
Supply your key to your script as NINJABUY_API_KEY and send it in the Authorization header:
curl -sS https://www.ninjabuy.com/api/v1/links \
-H "Authorization: Bearer $NINJABUY_API_KEY" \
-H "Content-Type: application/json" \
--data '{"links":["https://weidian.com/item.html?itemID=7581746714"]}'The same header works on every authenticated REST route: Links, Search, uploads and Sheets, and Jobs. The OpenAPI document needs no authentication.
Permissions and limits
Every key gets all three permissions. There is no scope picker.
| Permission | Routes |
|---|---|
links:create | POST /api/v1/links, POST /api/v1/uploads, POST /api/v1/sheets |
jobs:read | GET /api/v1/jobs/{id} |
search:read | GET /api/v1/search |
Keys and OAuth REST requests share the account's create and search windows. MCP link creation shares the create window too. See Rate limits.
A key cannot sign in, open a session, or call MCP or account APIs. Use OAuth for an application acting for other NinjaBuy customers or an MCP client.
Failures
An invalid, expired or revoked key returns the same 401 problem as an invalid OAuth token. A key-storage outage returns 503 with Retry-After. See Errors.