Authentication
API keys, the X-Api-Key header, and how requests are authenticated.
Every request to the AveTrust API is authenticated with an API key, sent in
the X-Api-Key header.
curl https://api.avetrust.net/api/v1/sessions \
-H "X-Api-Key: $AVETRUST_API_KEY"Not a Bearer token
AveTrust uses X-Api-Key: <key>, not Authorization: Bearer …. This is a
common mistake when porting from other APIs.
Key prefixes
| Prefix | Environment | Behaviour |
|---|---|---|
sk_test_… | Sandbox | Simulated verdicts allowed, no real captures billed |
sk_live_… | Production | Real verifications |
The SDKs derive the environment from the prefix — a key starting with sk_test_
puts the client in sandbox mode automatically.
Using a key in the SDKs
import { AveTrust } from "@avetrust/node";
const av = new AveTrust(process.env.AVETRUST_API_KEY!);
// Base URL defaults to the AveTrust API; override with { baseUrl } if needed.Where to get a key
Create and rotate keys from your dashboard (API keys section). Each key belongs to one organization — requests are scoped to that tenant.
Keep keys secret
Never expose an API key in client-side code or a public repository. The hosted
portal uses short-lived session tokens (st_…), not your API key — those are
safe to put in the verification link.
Next steps
- Sandbox — test end to end without a phone.
- Quickstart — your first verification.