Authentication

API keys, JWT, and signed-state OAuth.

TrustVerify accepts two credential types: programmatic API keys (live + test) for server-side calls, and JWT bearer tokens for dashboard-style flows.

Every request is rate-limited per-tenant per-plan; quotas are returned in `X-RateLimit-Remaining`.