Authentication headers secure the connection between SellerShorts and your AI automation. You must configure at least one authentication header to verify that webhook requests come from our platform.
Overview
Outbound authentication (SellerShorts → your webhook): When buyers run your AI Tool, we POST inputs to your webhook URL and include the headers you configure here (e.g., Authorization: Bearer or x-api-key). This lets your agent verify the request is from SellerShorts.
Inbound authentication (your system → SellerShorts): When you POST results to our callback URL, include the generated x-callback-secret. That secret is managed in the Connect step and is validated by SellerShorts.
Required authentication
Outbound (to your webhook): Add at least one header (Authorization: Bearer or x-api-key). We include these on every POST.
Inbound (your callback to us): Always include x-callback-secret from the Connect step.
Recommended header patterns
Authorization: Bearer (recommended)
Format: Authorization: Bearer YOUR_TOKEN
Best for: OAuth tokens, JWT tokens, modern API services
Wrong header name – Check exact header name expected
Invalid token – Verify token value is correct
Token format – Ensure proper Bearer prefix if required
403 Forbidden errors
Valid but insufficient – Token exists but lacks permissions
Expired token – Refresh or regenerate authentication token
Blocked source – Whitelist SellerShorts IP ranges if needed
Rate limited – Check if too many requests are being blocked
Header configuration in SellerShorts
In the Connect step of the submission wizard:
Add header – Click "Add Header" button
Enter name – Type header name (e.g., "Authorization")
Enter value – Type full header value (e.g., "Bearer your-token")
Save configuration – Headers are saved with your AI Tool
Test connection – Verify headers work before proceeding
🔒 Security reminder
Never share authentication tokens publicly or include them in screenshots. Treat them like passwords. If a token is compromised, rotate it immediately and update your AI Tool configuration.