Partner API: Authentication

The Partner API is hand-onboarded — there's no public signup. Once your Exlitem contact activates your account, you'll receive a secret key.

#Getting Your Key

• Keys are issued by Exlitem when your Partner API account is created and are shown to you once. Store it in a secrets manager immediately — Exlitem cannot re-display it.
• Keys can be rotated on request. The old key remains valid for 24 hours after rotation, so you can roll over without downtime.
• Keys are server-side credentials only. Never ship a Partner API secret key in a browser bundle, mobile app, or any client-visible code — that's what the search widget's publishable key is for.

#Making Authenticated Requests

Every request must carry your secret key as a bearer token:

Authorization: Bearer exl_partner_live_9f2c41d8a7b356e0c1d2e3f4a5b6c7d8

Requests without a valid key receive 401 UNAUTHORIZED.

#Test vs. Live Keys

Because test keys currently query the live database, treat any expert data returned to a test key as real and confidential during integration — the same as production data.

#Verifying Connectivity

Use GET /ping to confirm your key works before building anything else:

GET /partner/v1/ping
Authorization: Bearer exl_partner_test_...

{
  "success": true,
  "data": { "status": "ok", "environment": "test", "partner": "Acme Legal Tech" },
  "pagination": null,
  "error": null
}

If this returns 401 UNAUTHORIZED, double-check the key was copied in full and that you're sending it as Authorization: Bearer <key>, not as a query parameter or custom header.

#Next Steps

Once GET /ping succeeds, move on to Search & Profile Endpoints to start integrating search.