Authentication

Your backend authenticates every /v1 request with an API key in the x-api-key header. There is no OAuth flow and no request signing; send the key over HTTPS only.

curl https://kycverify.me/api/v1/workflows -H "x-api-key: kyc_test_8kQ2…"

Key format

kyc_test_ or kyc_live_ followed by 32 URL-safe characters from 24 random bytes. The environment comes from the app the key was created in. The key is shown once when created; the console afterwards shows only its first 12 characters.

Scope

• A key belongs to exactly one app. Every query it makes is filtered by that app's id, so a key can never read another app's sessions, even in the same organisation.
• Asking for a session that exists in another app returns 404 not_found, not 403, so ids cannot be probed.
• Creating and revoking keys needs the admin role in the console. Both actions are audited (api_key.created, api_key.revoked).

How keys are stored

The server keeps the 12-character prefix and a SHA-256 hash of the key, and compares hashes. A copy of the database is not a set of working keys. Each successful call updates the key's last_used_at, shown in the console so you can spot unused keys.

Rotating a key

1. Create a new key in the same app.
2. Deploy it to your backend's secret store.
3. Revoke the old key. Requests with it fail immediately with 401 unauthorized: Invalid or revoked API key.

The three credentials