# Partner API The Partner API is a separate surface from v1. A POS or ordering platform uses it to enrol its merchants’ stores, then read their reservations, published content and monthly billing. It is live for signed partners. It is not self-serve: CreatoRain issues each partner a key. ## Hosts Mode Host Production `https://data.creatorain.com/partner/v1` Sandbox, for integration tests `https://datadev.creatorain.com/partner/v1` ## Authentication One long-lived key per partner, sent as `Authorization: Bearer `. Keys look like `crp_live_...` on production and `crp_test_...` elsewhere. - The header is `Authorization` on every route. There is no `x-api-key` header. A key sent in one is not read, and the answer is `401 unauthorized`. - A key is scoped to one account and one campaign. It cannot read another customer’s data. - A key may carry an IP allowlist. Another address is `403 forbidden_ip`. ## Errors ```json { "error": { "code": "location_already_exists", "message": "...", "field": "partner_location_id" } } ``` Branch on `code`, never on `message`. This envelope is frozen for partners. It differs from v1’s. ## Rate limit 600 requests a minute per key by default. Over it: `429 rate_limited`, with `RateLimit-*` headers. ## Reference The [Partner reference](/partner-api/reference/) is generated from the partner spec. The raw spec is at [`/partner-openapi.json`](/partner-openapi.json).