Authenticate every request

Tenant API keys scope requests and payment records to one integration.

Use the x-api-key header

Send the raw tenant key in the x-api-key header on every /v1 request. Missing, invalid, inactive, or rotated keys return 401.

curlbash

curl "${API_URL}/v1/banks" \
  --header "x-api-key: ${VE_BANKING_API_KEY}"

A rotated key invalidates the previous key. Update the secret in each environment atomically and verify with GET /v1/banks.