Authentication

Every request must carry your API key as a Bearer token.

Authorization: Bearer YOUR_API_KEY
Accept: application/json

POST requests also send Content-Type: application/json.

curl --request GET \
  "https://api.boostigo.io/likee/user/1137852558" \
  --header "Authorization: Bearer YOUR_API_KEY" \
  --header "Accept: application/json"

#API keys

Each API key belongs to exactly one store and one platform (Likee).
Keys look like bst_live_…. Boostigo stores only a hash; the full key is shown once when created. If you lose it, Regenerate it in the Client Dashboard (the old key stops working immediately).
Each key has its own balance, rate limit, optional IP whitelist, and webhook settings.
Revoked or disabled keys are rejected with API_KEY_DISABLED.

#Checks performed on every request

Order	Check	Error on failure
1	API key exists	`401 INVALID_API_KEY`
2	API key is active	`403 API_KEY_DISABLED`
3	Store is active	`403 STORE_DISABLED`
4	Likee is enabled for this key	`403 PLATFORM_NOT_ENABLED`
5	Client IP allowed (if a whitelist is set)	`403 IP_NOT_ALLOWED`
6	Rate limit not exceeded	`429 RATE_LIMIT_EXCEEDED`

{ "success": false, "error": { "code": "INVALID_API_KEY", "message": "Invalid API key." } }

#Keep your key secret

Call the API from your server, never from browsers or mobile apps.
Do not log the Authorization header.
Use the IP whitelist (Client Dashboard → API key → Edit) to pin the key to your servers.
Rotate with Regenerate if you suspect exposure.