Authentication

This guide is for developers. It explains how to generate a secret key and use it to call the Propcart API.

Step 1: Generate a secret key

info

Only the account owner (the person who originally created your Propcart account) can generate or revoke secret keys. This can't be delegated to other admin users, even ones with full "All Access" permissions.

1. Go to Settings > Integrations.
2. Scroll to the Secret Keys section and click Add Secret Key.
3. Give it a label describing what it's for (for example, "Looker Studio dashboard" or "Accounting sync").
4. Click Add.

Propcart generates a secret and shows it to you once.

caution

Copy this secret now. Propcart doesn't store it and can't show it to you again. If you lose it, revoke that key (see below) and add a new one.

Treat it like a password — anyone with this secret can read your Propcart data. Avoid pasting it into email or chat in plain text if you can help it.

Step 2: Find your Vendor ID

Every request needs your Vendor ID as part of the URL. It's shown right next to your secret keys, on the same Settings > Integrations > Secret Keys page.

Step 3: Call the API

Send your secret key as a Bearer token in the Authorization header of your request.

curl "https://dash.propcart.com/api/v1/vendors/YOUR_VENDOR_ID/items" \
  -H "Authorization: Bearer YOUR_SECRET_KEY"

Most endpoints return JSON by default. Add an Accept: text/csv header to get a CSV file instead — the same data you'd get from the corresponding export button in the Dashboard.

curl "https://dash.propcart.com/api/v1/vendors/YOUR_VENDOR_ID/items" \
  -H "Authorization: Bearer YOUR_SECRET_KEY" \
  -H "Accept: text/csv"

If your account is not on Propcart's North America server (the default), your API base URL is different. Ask your Propcart contact which server your account is on if you're not sure.

Every endpoint follows the same shape:

https://propcart.com/api/v1/vendors/{vendorId}/{endpoint}

See Endpoints for the full list of what you can request, including which ones take additional query parameters.

info

The API is currently read-only — only GET requests are supported. A secret key can't create, update, or delete anything in your account.

Revoking a key

Every secret key you've generated shows up as a row under Settings > Integrations > Secret Keys. Click a row to open it.

• Active toggle — turn a key off temporarily without deleting it. Turning it back on lets it work again immediately, using the same secret you already have — no new secret needed.
• Delete — permanently removes the key. There's no undo, and the deleted secret can never be reused. If you need it again later, add it again to get a brand new secret.

Either way, a revoked or deleted key stops working on its very next request.

Errors

Status	Meaning
401	The secret key is missing, invalid, or has been revoked.
403	The secret key is valid, but the request isn't allowed — for example, a non-GET request.
422	The request is missing a required parameter, or a parameter has an invalid value.