Authentication

VeroID uses API keys for authentication. Each request must include a valid API key in the X-API-Key header.

API keys require a developer account. VeroID accounts come in two mutually exclusive types. A developer account gets API keys and pays a one-time onboarding fee. A dashboard account runs checks from the VeroID dashboard instead, pays no onboarding fee, and is never issued API keys.

API key types

Every verification is checked with the document issuer or official record holder. There is no simulated mode. VeroID issues two key types, each bound to one endpoint.

Test keys (`sk_test_*`)

Issued after the developer onboarding fee is paid. After you move to the production verification hub, you keep using the same test key on test-api for integration and staging once production access is approved.
Send requests to https://test-api.veroid.com.au only
Real verifications against the test verification environment
No credits deducted

Live keys (`sk_live_*`)

Issued once your onboarding fee is settled, your account is on the production verification hub, and VeroID approves production access
Send requests to https://api.veroid.com.au only
Real verifications against live production verification
Deduct 1 credit per verification (Y, N, or D outcomes)

Keys only work on their matching endpoint. A sk_test_* key on api.veroid.com.au, or a sk_live_* key on test-api.veroid.com.au, returns 403 with code WRONG_API_ENDPOINT.

Using API keys

Test hub verification:

curl -X POST https://test-api.veroid.com.au/v1/verify \
  -H "Content-Type: application/json" \
  -H "X-API-Key: sk_test_your_api_key" \
  -d '{ ... }'

Production verification:

curl -X POST https://api.veroid.com.au/v1/verify \
  -H "Content-Type: application/json" \
  -H "X-API-Key: sk_live_your_api_key" \
  -d '{ ... }'

Security best practices

Store keys in a secrets manager or CI variable. Never put them in source control or mobile apps.
Use one key per environment (test vs live) and per integration where possible.
Rotate after staff changes or if a key may have leaked: create a new key in the dashboard, deploy the new value, then revoke the old key.
Monitor usage in the dashboard; unexpected volume may mean a leaked key.

export VEROID_API_KEY="sk_live_..."

Never expose keys in client-side code, Git repositories, or public URLs.