Skip to main content

Authentication

Authentication uses API keys with Bearer auth.

Authorization: Bearer <API_KEY>

API Key Constraints​

API keys are issued with an access type and linked to:

  • One or more companies, or one or more agencies
  • Scope permissions
  • Optional IP allowlist
  • Optional expiry date

Company-scoped keys can access data for the companies attached to the key.

Agency-scoped keys are limited to the agencies attached to the key and only to data for companies that are connected to those agencies.

Keys are stored hashed in the database and can be revoked at any time. Requidex automatically revokes a key when it has not been used for 30 days. For a key that has never been used, the 30-day period starts when the key is created.

Rejection Conditions​

Requests are rejected when the key is:

  • Missing
  • Invalid
  • Revoked
  • Expired
  • Not valid for the current environment
  • Not allowlisted by IP