Authentication

API keys, Bearer authentication and key rotation.

This documentation covers API V1.

Bearer authentication

All API requests require an API key in the Authorization header. Two key types exist: sk_test_ for the sandbox and sk_live_ for production traffic.

http

Authorization: Bearer sk_test_xxx

bash

curl -s "https://api.fincode.example.com/v1/banks" \
  -H "Authorization: Bearer sk_live_xxx"

Keeping keys safe

Only the key hash is stored server-side. Never commit keys to source control; use environment variables or a secrets manager. Rotate keys from the dashboard — old keys keep working for a configurable grace period to avoid downtime.

Authentication errors

Code	HTTP	Description
UNAUTHORIZED	401	Missing or invalid API key.
FORBIDDEN	403	The key does not have access to this endpoint.