Authentication

Every request needs a Bearer API key from the dashboard:

Authorization: Bearer sk_live_…

Key types

Key	Runs against	Billed
sk_live_…	Real bank integrations	Yes, consumes credits
sk_test_…	The sandbox (synthetic data)	No

Both use the same base URL. Only the key changes.

Keep keys server-side. Do not put them in browser or mobile code.

Check a key

GET /auth/validate returns information about the key that made the call. Use it in your deployment checks.

Errors

Failed requests return a JSON body with a stable code and a human-readable message. Branch on code, not on message.

HTTP	code	Meaning
401	unauthorized	Missing or invalid API key
403	org_not_verified	Your link profile isn’t verified yet. See Verification.
404	not_found	The resource was not found
429	rate_limited	Too many requests. Back off and retry.

Some endpoints can also return insufficient_credits when the organisation has no remaining credits. Check the endpoint’s reference page for its full list of responses.

{
  "error": {
    "code": "unauthorized",
    "message": "Invalid or missing API key"
  }
}