Authentication
Every machine request uses a scoped Bearer API key.
Bearer key #
Code example
Authorization: Bearer $GOWALY_API_KEYKey formats are gwy_test_<16 lowercase hex>_<43 base64url> and gwy_live_<16 lowercase hex>_<43 base64url>. These are format descriptions, not example credentials.
Environment binding #
A key prefix does not choose the environment. The hostname and the key's stored environment must match. Staging and Customer Sandbox keys are not interchangeable.
Exact scopes #
| Scope | Operations |
|---|---|
| verification:read | POST /api/v1/check-recipient |
| reports:write | POST /api/v1/reports; GET /api/v1/reports/{report_id}; POST /api/v1/reports/{report_id}/evidence; POST /api/v1/reports/{report_id}/evidence/{evidence_id}/confirm |
Only verification:read and reports:write are Commercial API scopes.