Authentication

The Client API uses API keys. Every request must include your key in the X-API-Key header:


curl https://vault.example.com/api/v1/profiles/$PROFILE_ID/wallets \
  -H "X-API-Key: <your-api-key>"

Keys are issued from the dashboard under Settings → API Keys.

Obtaining a key

API keys are created in the dashboard: Settings → API Keys → Create key. Creating a key requires step-up MFA, and the full key value is displayed only once at creation time — store it in your secret manager immediately.

Keys are bound to the profile they were created in; a key for one profile cannot access another profile’s resources.

Key handling

Send the key only in the X-API-Key header over HTTPS — never in URLs, query strings, or logs.
Rotate by creating a replacement key, migrating your integration, then revoking the old key in the dashboard.
Revocation is immediate: requests with a revoked key receive 401.

Treat API keys like passwords. Anyone holding a key can act on your profile — but only within the policy rules configured for it. Whitelists, limits, and approval quorums apply to API-initiated transfers, and mobile signer approval is still required for signing, so a leaked key alone cannot move funds to an unapproved destination.

What is not in this API

Interactive authentication — user login, sessions, second-factor (MFA) enrolment, password recovery — belongs to the dashboard and mobile app, not the public Client API. User accounts, roles, and device enrolment are likewise managed in the dashboard. See Users & Access for how they work.