Authentication

All requests to The Trade Hub API must be authenticated using an API key passed via the X-API-Key HTTP header.

Getting an API key

API keys are created from your organization's developer dashboard:

1. Sign in to your The Trade Hub account
2. Go to developer settings
3. Click Create API Key
4. Name your key and select the scopes (classify, export_control)

Key format

All API keys use the th_live_ prefix followed by 32 random hexadecimal characters:

th_live_a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5p6

The prefix shown in the dashboard (th_live_xxxx) identifies the key without exposing its full value. The complete key is only visible at creation time.

Usage

Include your API key in the X-API-Key header of every request:

curl -X POST https://api.thetradehub.eu/v1/classify/jobs \
  -H "X-API-Key: th_live_your_api_key" \
  -H "Content-Type: application/json" \
  -d '{"content": "Wireless Bluetooth headphones"}'

import httpx

client = httpx.Client(
    base_url="https://api.thetradehub.eu",
    headers={"X-API-Key": "th_live_your_api_key"},
)

response = client.post("/v1/classify/jobs", json={
    "content": "Wireless Bluetooth headphones"
})
print(response.json())

const response = await fetch("https://api.thetradehub.eu/v1/classify/jobs", {
  method: "POST",
  headers: {
    "X-API-Key": "th_live_your_api_key",
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    content: "Wireless Bluetooth headphones",
  }),
});

const data = await response.json();
console.log(data);

Response for invalid key

If the API key is missing or invalid, the API returns a 401 Unauthorized error:

{
  "detail": "Invalid or missing API key"
}

Security best practices

Never expose your key on the client side

Your API key must never appear in frontend code (browser JavaScript, mobile app). Always make API calls from your backend server.

Use environment variables

Store your keys in environment variables, never hardcoded in source code:

# .env
TRADEHUB_API_KEY=th_live_your_api_key

import os
api_key = os.environ["TRADEHUB_API_KEY"]

Regular rotation

Rotate your API keys regularly:

• Create a new key in the developer dashboard
• Update your systems with the new key
• Delete the old key once migration is complete

Least privilege

Create dedicated keys per service or application. In case of compromise, only the affected key needs to be revoked.

Monitoring

Monitor your API key activity from the dashboard. Unusual requests (abnormal volume, unused endpoints) may indicate a leak.