Menu

Authentication

Authentication

Create API keys in your back office. Sign every call.

API keys

Create API keys in your back office. Each key pair is made in your browser. You keep the private key. We keep only the public key.

Each key has:

Apps

Use one key for each app or server. Then you can turn one off alone.

Signing calls

Every call, both ways, is signed with the sender’s private key. We use ECDSA P-256 with SHA-256.

Each call has four headers.

HeaderWhat it holds
Key-IdWhich key signed the call.
EnvironmentWhich environment the call is for.
Sent-AtWhen the call was sent.
SignatureThe signature, made with the sender’s private key.

A call older than 5 minutes is refused.

A signed call · POST /v1/session.startExample
Key-Id: key_7Hq2Xc9LpQ
Environment: staging
Sent-At: 2026-10-31T12:20:00Z
Signature: MEUCIQD3…

{ "requestId": "r-01JC9B…",
  "firstSentAt": "2026-10-31T12:20:00Z", … }

IP addresses

On Live, every key needs its IP addresses.

Changing a key

  1. 1

    Create a new key.

  2. 2

    Move your servers to it.

  3. 3

    Delete the old key.

Previous← Sandbox and LiveNextEnvironments →