Authentication

Developer-facing API endpoints require authentication via API keys passed in the Authorization header. Wallet-facing and OID4VC protocol endpoints (credential offer retrieval, token exchange, presentation submission) are keyless by design, since wallets have no API key to present.

API key types

API keys are opaque access tokens with the oat_ prefix. Whether a key is publishable or secret is a property you choose when creating the key in the dashboard; it is not encoded in the token string itself.

Key type	Access level
Publishable	Browser-safe endpoints: verification requests and status polling, credential offer creation, 2D-DOC verify/scan/compare, proximity verification, Digital Credentials API, NFC identity reads, CAMARA telecom checks, liveness sessions (create, report, reference upload, artifacts except raw media), read-only template and data source lookups
Secret	Everything publishable keys can do, plus write and expensive operations: template creation, document analysis, DPP issuance, OCR verification, monitoring, API-only liveness analysis (`POST /liveness/analyze`) and raw liveness media

Liveness subject endpoints (/liveness/public/sessions/:id/*) take no API key: the capture page authenticates with the per-session bearer token returned by POST /liveness/sessions. See Liveness.

Usage

Include your API key in the Authorization header with the Bearer scheme:

POST /verifier/request
Authorization: Bearer oat_your_publishable_key
Content-Type: application/json

{ "version": "v1" }

Publishable keys and origins

Publishable keys are meant for browser use, where the Origin header is sent automatically. Every request made with a publishable key must carry an Origin header matching one of the key's allow-listed origins (configured in the dashboard):

Requests whose Origin header does not match an allowed origin are rejected with 403.
A publishable key with no allowed origins configured is rejected outright.

This is also why publishable keys fail for server-side calls, which send no Origin header. Use a secret key on your server instead.

Key management

API keys are created and managed from the dashboard at /dashboard/api-keys. The key kind (publishable or secret) and, for publishable keys, the allowed origins are set at creation time.

Security guidelines

Use publishable keys in frontend code (browser, mobile apps) and configure their allowed origins
Use secret keys only on your server; never expose them in client-side code
Rotate keys if you suspect they've been compromised
Use separate keys for development and production

Rate limits

API-key-protected endpoint groups are rate limited to 200 requests per minute per API key (requests that carry no key are counted per IP address). Keyless protocol endpoints (OID4VCI/OID4VP) used by wallets have a separate limit of 60 requests per minute per IP address.

If you exceed the limit, the API returns 429 Too Many Requests.