Transmission
Send the secret in the X-API-Key request header. The implemented company API does not accept it as a Bearer token. Example: X-API-Key: YOUR_API_KEY.
Developer & API documentation
API Authentication
Use the credential model required by the implemented route. Company API keys and mobile bearer tokens are separate and are not interchangeable.
Company API keys
An authorized Enterprise company administrator (or super administrator) creates a named key in Company API Keys. The complete secret is displayed once; only a SHA-256 hash and masked preview are retained.
Lifecycle
The management page shows name, company, masked key, active/revoked status, created time where installed, and last-used time. Keys can be created or irreversibly revoked. Rotation is performed by creating a replacement, deploying it, then revoking the old key; there is no separate rotate operation or configurable scope field.
Audit
Creation and revocation write application and identity audit events where the installed audit components are available. Raw secrets are not audit content.
Bearer and session authentication
Mobile bearer tokens
Employee/mobile login issues a time-limited token used by app routes. This credential is for the first-party app workflow, not the company server API.
Administrator sessions
API-key and webhook configuration screens require an authenticated administrator session, authorization checks, plan checks, and CSRF validation for changes. CSRF tokens do not replace API authentication and are not sent to server-to-server JSON routes.
Continue reading
Control how employees represent your company externally
Explore the CardIQ platform or review the workflow from verification through identity deactivation.
See how CardIQ works View pricing