> Portal Navigation:
> 
> - Append `.md` to any URL under `https://dev.wix.com/docs/` to get its markdown version.
> - Pages are either content pages (article or reference text) or menu pages (a list of links to child pages).
> - To get a menu page, truncate any URL to a parent path and append `.md` (e.g. `https://dev.wix.com/docs/sdk.md`, `https://dev.wix.com/docs/sdk/core-modules.md`).
> - Top-level index of all portals: https://dev.wix.com/docs/llms.txt
> - Full concatenated docs: https://dev.wix.com/docs/llms-full.txt

## Resource: Make REST API Calls with an API Key

## Article: Make REST API Calls with an API Key

## Article Link: https://dev.wix.com/docs/develop-websites/articles/coding-with-velo/authorization/make-rest-api-calls-with-an-api-key.md

## Article Content:

# Make REST API Calls with an API Key

Once you've [generated an API key](https://dev.wix.com/docs/develop-websites/articles/coding-with-velo/authorization/generate-an-api-key.md) and obtained the IDs for your Wix account or site, you can authenticate and perform admin operations.

## Step 1 | Set authorization headers

To make an API call using an API key, include the key from the [API Keys Manager](https://manage.wix.com/account/api-keys) in the `Authorization` header. You must also include one of the following headers, depending on the type of call:

- `wix-account-id`: The ID of the Wix account that owns the API key. Required for account-level API calls.
- `wix-site-id`: The ID of the Wix site you're working with. Required for site-level API calls.

> **Notes:**
> - API calls require either the `wix-account-id` header or the `wix-site-id` header, but not both. Most APIs are site-level, while account-level APIs are specified as such in the reference documentation.
> - Site-level calls only work with API keys that belong to the account that owns the site.

A complete header for an account-level API request looks like this:

```sh
curl <GET/POST> \
  '<endpoint>' \
  -H 'Authorization: <API_KEY>' \
  -H 'wix-account-id: <ACCOUNT_ID>'
```

A complete header for a site-level API request looks like this:

```sh
curl <GET/POST> \
  '<endpoint>' \
  -H 'Authorization: <API_KEY>' \
  -H 'wix-site-id: <SITE_ID>'
```

## Step 2 | Make a REST API call

With your headers set up, call Wix APIs. The following example calls [Query Product](https://dev.wix.com/docs/api-reference/business-solutions/stores/catalog-v3/products-v3/query-products.md) and retrieves a list of visible [products](https://dev.wix.com/docs/api-reference/business-solutions/stores/catalog-v3/products-v3/introduction.md) from a specific site:

```sh
curl -X POST \
  'https://www.wixapis.com/stores/v3/products/query' \
  -H 'Content-Type: application/json' \
  -H 'Authorization: <API_KEY>' \
  -H 'wix-site-id: <SITE_ID>' \
  -d '{
    "query": {
      "filter": { "visible": { "$eq": true } },
      "sort": [{ "fieldName": "createdDate", "order": "DESC" }],
      "cursorPaging": { "limit": 10 }
    }
  }'
```

## Common errors

### 403 forbidden

If you receive a `403 Forbidden` error, check that you have:

- An `Authorization` header with your API key.
- The correct [permissions](https://dev.wix.com/docs/overview/auth-permissions/permissions.md) configured for your API key.
- A `wix-site-id` header for site-level methods, or a `wix-account-id` header for account-level methods.
- An API key that can access the site you're calling. A key scoped to specific sites only works for those sites.
- An API key that belongs to the account that owns the site you're calling. A key works only for sites in its own account, no matter which account member generated it.

### Unable to generate a key

If you don't receive an SMS for 2-step verification when generating a key, [contact Wix Support](https://support.wix.com/en/article/contacting-wix-support).

## See also

- [Authentication Methods](https://dev.wix.com/docs/overview/auth-permissions/authentication-methods.md)
- [Generate an API Key](https://dev.wix.com/docs/develop-websites/articles/coding-with-velo/authorization/generate-an-api-key.md)