Skip to main content
Every request to /b2b/* and /retailer/v1/* is authenticated with an API key in the X-API-Key header.
A missing or invalid key returns 401 UNAUTHORIZED. A suspended account returns 403 on every call.

​
Create an API key

1

Sign in to the dashboard

Create a Wizzgift account at wizzgift.com and sign in.
2

Create a key

Go to Account → API Keys and create a key. Creating your first key automatically enrolls you as a starter-tier business with the b2b capability enabled — no separate signup step.
3

Store the key immediately

The key looks like wg_live_... and is shown exactly once. Only a hash is stored server-side; a lost key must be replaced.
Treat API keys like passwords. Keep them in your server-side environment, never in client-side code, and rotate them from the dashboard if they leak.

​
Key scopes

Each key carries a list of scopes. Operations in the API reference state the scope they require. A key without the needed scope gets 403 FORBIDDEN. Pick the scopes when you create the key — the dialog lists all of them, with every scope selected by default. Scopes are fixed once the key exists; to change them, create a replacement key and delete the old one. Grant only what the integration needs — a reporting job wants just products:read and orders:read, not the create scopes. A key with the * scope has full access; keys created before scopes existed also carry full access and keep working. Any scope outside the table above is rejected at creation with 400 VALIDATION_ERROR.

​
Account capabilities

Scopes control what a key may do; capabilities control which surfaces your account can use:
  • b2b — enabled automatically when you create your first API key.
  • retailer — enable it in the dashboard business settings, or contact support.
Calling a surface whose capability is off returns 403 FORBIDDEN with a hint in the error message.

​
Account status

Your account status is visible on GET /b2b/account: