API Keys

Getting Your API Key

Go to verilock.io/dashboard and sign in with your account.

Navigate to API Keys

Open Settings > API Keys from the sidebar.

Create a new key

Click “Create API Key”, give it a descriptive name (e.g., Production Backend, Staging Server), and copy the generated key.

The full API key is displayed only once at creation. Store it in a secure secrets manager immediately. If lost, revoke the key and create a new one.

Property	Type	Description
`name`	string	Human-readable label for identification
`key`	string	The API key value — use in the `Authorization: Bearer` header
`prefix`	string	`qi_live_` for production, `qi_test_` for sandbox
`created_at`	datetime	When the key was generated
`last_used_at`	datetime	Last time the key was used for an API call

Store keys in VERILOCK_API_KEY env vars. Never hardcode them in source code.

Use distinct keys for development, staging, and production. Revoke keys when environments are decommissioned.

Rotate production keys quarterly. Create the new key, update your services, then revoke the old key.

Never include API keys in frontend code, mobile apps, or client-side JavaScript. All calls must come from your backend.

VERILOCK_API_KEY=qi_live_your_api_key_here
VERILOCK_WEBHOOK_SECRET=whsec_your_webhook_secret_here

'verilock' => [
    'api_key' => env('VERILOCK_API_KEY'),
    'webhook_secret' => env('VERILOCK_WEBHOOK_SECRET'),
],

const verilock = new Verilock(process.env.VERILOCK_API_KEY);