Authentication

Every request carries your API key as a bearer token in the Authorization header. The libraries add it for you.

Test keys#

Test keys start with sk_test_. Create one on verisec.dev under API keys. The secret is shown once, so store it straight away.

Terminal

curl https://verisec.dev/v2/bin/424242 \
  -H "Authorization: Bearer $VERISEC_API_KEY"

import { VeriSec } from "@veriseclabs/node";

// Leave apiKey out and the client reads VERISEC_API_KEY.
const client = new VeriSec({ apiKey: process.env.VERISEC_API_KEY });

A key can carry limits you set when you create it: which APIs it may call, the IP addresses it may come from, an expiry date and a spending cap. A call outside those limits answers 403, and one over the spending cap answers 402.

Live keys#

Live keys start with ak_live_ and come with a client ID and a client secret. A live key is never sent on its own: it's exchanged with the client ID and secret for a short-lived token, and the libraries do that exchange, cache the token and renew it for you.

const client = new VeriSec({
  apiKey: process.env.VERISEC_API_KEY, // ak_live_…
  clientId: process.env.VERISEC_CLIENT_ID,
  clientSecret: process.env.VERISEC_CLIENT_SECRET,
});

Keeping keys safe#

Call the API from your server only. Never put a key in a browser, a mobile app or a public repository.
Use a separate key per service, so you can revoke one without touching the others.
Revoke a key on verisec.dev the moment you think it leaked. Requests made with it then answer 401.

Rate limits#

Each key has a request rate limit. Above it, the API answers 429 with a Retry-After header saying how many seconds to wait; the libraries wait and retry for you. See Retries.