Skip to main content

​
API Key Authentication

All requests to the Verilock API must include your API key in the Authorization header as a Bearer token.
Keep your API keys secure. Never expose keys in client-side code, public repositories, or browser requests. All API calls must originate from your backend server.
Required Headers
Authorization: Bearer qi_live_your_api_key_here
Content-Type: application/json
Accept: application/json

curl -X GET \
  "https://verilock.io/api/v1/sessions" \
  -H "Authorization: Bearer qi_live_your_api_key_here" \
  -H "Accept: application/json"

$client = new \GuzzleHttp\Client();
$response = $client->get(
  'https://verilock.io/api/v1/sessions',
  ['headers' => [
    'Authorization' => 'Bearer qi_live_your_api_key_here',
    'Accept' => 'application/json',
  ]]
);

import requests

response = requests.get(
    "https://verilock.io/api/v1/sessions",
    headers={
        "Authorization": "Bearer qi_live_your_api_key_here",
        "Accept": "application/json",
    }
)

const response = await fetch("https://verilock.io/api/v1/sessions", {
  headers: {
    "Authorization": "Bearer qi_live_your_api_key_here",
    "Accept": "application/json",
  },
});
const data = await response.json();

​
Key Prefixes

PrefixEnvironmentUsage
qi_live_ProductionLive API requests with real data
qi_test_SandboxTesting and development — no charges, simulated results
Use qi_test_ keys during development. They return simulated verification results and are free to use.

​
Rate Limiting

API requests are rate limited per API key. Current limits are returned in response headers:
HeaderDescription
X-RateLimit-LimitMaximum requests per minute
X-RateLimit-RemainingRemaining requests in current window
Retry-AfterSeconds until rate limit resets (only on 429)
Default rate limit is 120 requests/minute per API key. Contact us if you need higher limits for production workloads.

​
Authentication Errors

If authentication fails, the API returns a 401 status:
401 Unauthorized
{
  "error": "authentication_error",
  "message": "Invalid or missing API key.",
  "details": null
}
Common causes:
  • Missing Authorization header or invalid Bearer token format
  • Invalid or revoked API key
  • Using a test key against production endpoints (or vice versa)