Authentication
API key management and security best practices
VeroID uses API keys for authentication. Each request must include a valid API key in the X-API-Key header.
API keys require a developer account. VeroID accounts come in two mutually exclusive types. A developer account gets API keys and pays a one-time onboarding fee. A dashboard account runs checks from the VeroID dashboard instead, pays no onboarding fee, and is never issued API keys.
API key types
Every verification hits the real DVS. There is no simulated mode. VeroID issues two key types, each bound to one endpoint.
Test keys (sk_test_*)
- Issued when VeroID approves your account for the DVS test hub
- Send requests to
https://test-api.veroid.com.auonly - Real verifications against the DVS test environment
- No credits deducted
Live keys (sk_live_*)
- Issued once your onboarding fee is settled, your account is on the production DVS hub, and VeroID approves production access
- Send requests to
https://api.veroid.com.auonly - Real verifications against production DVS
- Deduct 1 credit per verification (Y, N, or D outcomes)
Keys only work on their matching endpoint. A
sk_test_* key on api.veroid.com.au, or a sk_live_* key on test-api.veroid.com.au, returns 403 with code WRONG_API_ENDPOINT.Using API keys
DVS test verification:
curl -X POST https://test-api.veroid.com.au/v1/verify \
-H "Content-Type: application/json" \
-H "X-API-Key: sk_test_your_api_key" \
-d '{ ... }'Production verification:
curl -X POST https://api.veroid.com.au/v1/verify \
-H "Content-Type: application/json" \
-H "X-API-Key: sk_live_your_api_key" \
-d '{ ... }'Security best practices
export VEROID_API_KEY="sk_live_..."
Never expose keys in client-side code, Git repositories, or public URLs.