Authentication

Authenticate API requests using Bearer tokens in the Authorization header. Each token is unique to your user account and provides access to your company's data.

Generate an API Token

Create your API token (integration key) to start making authenticated requests:

Log in to your Trustmarkt account at https://www.trustmarkt.de
Navigate to your profile by clicking on your avatar in the top right
Select Einstellungen (Settings)
Scroll to the bottom of the page
Find the section Integrationsschlüssel (Integration Keys)
Click to create a new integration key

❗️
If you can't find the section "Integrationsschlüssel", your account does not have access to the Trustmarkt API. Check if your company's plan has access to the feature "API-Zugang".

❗️
Store Your Token Securely
Your API token is displayed only once immediately after creation. Copy it and store it in a secure location (like a password manager or environment variable). You cannot retrieve it again later. If you lose it, you'll need to generate a new token.

You can create up to 5 active tokens per account. This allows you to use separate tokens for different integrations or environments (development, staging, production).

Making Authenticated Requests

Include your API token in the Authorization header using the Bearer authentication scheme:

Authorization: Bearer YOUR_API_TOKEN

curl https://api.trustmarkt.de/v1/reviews \
  -H "Authorization: Bearer tm_1234567890abcdef"

const fetch = require('node-fetch');

const apiToken = process.env.TRUSTMARKT_API_TOKEN;

const response = await fetch('https://api.trustmarkt.de/v1/reviews', {
  headers: {
    'Authorization': `Bearer ${apiToken}`,
    'Content-Type': 'application/json'
  }
});

if (!response.ok) {
  throw new Error(`HTTP error! status: ${response.status}`);
}

const data = await response.json();
console.log(data);

import requests
import os

api_token = os.environ.get('TRUSTMARKT_API_TOKEN')

headers = {
    'Authorization': f'Bearer {api_token}',
    'Content-Type': 'application/json'
}

response = requests.get(
    'https://api.trustmarkt.de/v1/reviews',
    headers=headers
)

response.raise_for_status()  # Raises error for 4xx/5xx responses
data = response.json()
print(data)

<?php
$apiToken = getenv('TRUSTMARKT_API_TOKEN');

$ch = curl_init();

curl_setopt($ch, CURLOPT_URL, 'https://api.trustmarkt.de/v1/reviews');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_HTTPHEADER, [
    'Authorization: Bearer ' . $apiToken,
    'Content-Type: application/json'
]);

$response = curl_exec($ch);
$httpCode = curl_getinfo($ch, CURLINFO_HTTP_CODE);

if ($httpCode >= 400) {
    throw new Exception("API request failed with status: " . $httpCode);
}

$data = json_decode($response, true);
curl_close($ch);

print_r($data);
?>

package main

import (
    "fmt"
    "io/ioutil"
    "net/http"
    "os"
)

func main() {
    apiToken := os.Getenv("TRUSTMARKT_API_TOKEN")
    
    client := &http.Client{}
    req, err := http.NewRequest("GET", "https://api.trustmarkt.de/v1/reviews", nil)
    if err != nil {
        panic(err)
    }
    
    req.Header.Add("Authorization", "Bearer "+apiToken)
    req.Header.Add("Content-Type", "application/json")
    
    resp, err := client.Do(req)
    if err != nil {
        panic(err)
    }
    defer resp.Body.Close()
    
    body, _ := ioutil.ReadAll(resp.Body)
    fmt.Println(string(body))
}

Premium Access Required

crown
Premium Subscription Required
API access is exclusive to Premium customers. Without an active Premium plan, all API requests will fail with a 403 Forbidden error, even with a valid token.

Upgrade your account to Premium at https://www.trustmarkt.de/preisgestaltung to enable API access.

Response when Premium is not active:

{
  "message": "This action is unauthorized."
}

HTTP Status: 403 Forbidden

Authentication Errors

Handle these authentication-related errors in your integration:

401 Unauthenticated

The Authorization header is missing, malformed, or contains an invalid token.

{
  "message": "Unauthenticated."
}

Common causes:

Missing Authorization header
Token format is incorrect (must be Bearer YOUR_TOKEN)
Token has been deleted or revoked
Token belongs to a different account

403 Authorization Error

You don't have permission to access the requested resource.

{
  "message": "This action is unauthorized."
}

Common causes:

No active Premium subscription
Attempting to access data from another company
Insufficient permissions for the requested action

Security Best Practices

Follow these guidelines to keep your API tokens secure:

Store tokens as environment variables
Never hardcode tokens in your source code. Use environment variables or secure secret management systems.

# .env file (never commit this to version control)
TRUSTMARKT_API_TOKEN=1000|1234567890abcdef

Use different tokens for different environments
Create separate tokens for development, staging, and production. If one is compromised, you can revoke it without affecting other environments.

Rotate tokens periodically
Regenerate tokens every few months as a security precaution. Delete old tokens after rotation.

Never share tokens
Each developer or system should use its own token. This makes it easier to track usage and revoke access when needed.

Delete unused tokens
Remove tokens you're no longer using to minimize security risks. You can view and delete tokens in your profile settings.

Token Management

Viewing Active Tokens

See all your active integration keys in your profile settings under Integrationsschlüssel. The list shows:

Token name (if provided during creation)
Creation date
Last used date

Revoking a Token

To revoke a token:

Go to your profile settings
Navigate to Integrationsschlüssel
Click the delete button next to the token you want to revoke
Confirm the deletion

Revoked tokens stop working immediately. Any requests using the revoked token will receive a 401 error.

Token Limits

Maximum tokens per account: 5
Token expiration: Tokens don't expire automatically, but should be rotated periodically for security

Testing Your Authentication

Use the /me endpoint to verify your authentication is working correctly:

curl https://api.trustmarkt.de/v1/me \
  -H "Authorization: Bearer YOUR_API_TOKEN"

Successful response:

{
  "id": "5GdkVeN8ZLaw29zBDXyb",
  "company_id": "XZzyJn9jEB1lWdvVRx6w",
  "name": "John Doe",
  "email": "[email protected]",
  "total_reviews": 42,
  "average_rating": 4.25,
  "trustability": {
    "social": true,
    "email": true,
    "phone": false
  },
  "url": "https://www.trustmarkt.de/nutzer/john-doe",
  "created_at": "2026-02-28T16:12:10+01:00"
}

If you receive this response, your authentication is configured correctly.

Need Help?

Having trouble with authentication? Contact our support team via the live chat on https://www.trustmarkt.de.