# Use the Starshipit API with child accounts
URL: https://support.starshipit.com/articles/90200000000524-use-the-starshipit-api-with-child-accounts
Canonical: https://support.starshipit.com/articles/90200000000524-use-the-starshipit-api-with-child-accounts
Markdown: https://support.starshipit.com/articles/90200000000524-use-the-starshipit-api-with-child-accounts.md
Updated: 2026-09-18

> For the complete documentation index, see [llms.txt](https://support.starshipit.com/llms.txt).

> Route API requests and orders to the correct Starshipit child account using that account's API key.

Use each child account's API key to create, read, or update orders in that account. Your integration chooses the destination account by choosing the API key for the request.

## Before you begin

- Set up each child account that your integration needs to access.
- Obtain and securely store the API key for each child account.
- Keep the subscription key required for your Starshipit API access with your other integration credentials.
- Decide which business value identifies the destination account, such as a location, brand, warehouse, or 3PL client.

See [Authentication and access](/articles/14700000001002-authentication-and-access) for the standard Starshipit API headers and security requirements.

## Route requests to a child account

1. Maintain a secure mapping between each location, brand, warehouse, or client and its child account API key.
2. Determine the destination child account before sending the request.
3. Read that account's API key from your secret store.
4. Send the key in the `StarShipIT-Api-Key` header.
5. Send the request to the normal Starshipit API endpoint.

For example, if an order belongs to your Auckland location, select the Auckland child account's API key before calling the order import endpoint. To create an order in a different child account, send the same request using that account's key.

:::important
The parent account's API key does not select a child account. Use the API key that belongs to the specific child account you want the request to access.
:::

## Keep account routing safe

- Store API keys in a secret manager or encrypted integration setting, not in source code.
- Use a stable account identifier in your mapping instead of selecting a key from free-text names.
- Do not include API keys in application logs, screenshots, or error messages.
- Update the stored mapping when an API key is regenerated.
- Reject or hold an order when its destination does not map to exactly one child account.

## Verify the destination account

Send a small read-only request with each stored API key and confirm the response contains data from the intended child account. When testing order creation or updates, use a controlled order and confirm it appears only in the selected child account.

If the request returns data from the wrong account, stop the integration and check which API key was selected. If it returns `401 Unauthorized`, confirm the API and subscription keys. If it returns `403 Forbidden`, confirm the key belongs to an account that can perform the requested action.

## Related guides

- [Starshipit API fundamentals](/articles/14700000001018-starshipit-api-fundamentals)
- [Import orders](/developers/api-reference/starshipit#tag/Orders)
- [Choose an account structure for multiple locations or 3PL clients](/articles/360000553016-choose-an-account-structure-for-multiple-locations-or-3pl-clients-child-accounts)
- [Set up a child account](/articles/360001575375-set-up-an-account-for-a-location-brand-or-3pl-client-child-accounts)