DocsAuthentication

Authentication

API keys, JWT bearer tokens, and signed-state OAuth.

TrustVerify accepts two credential types: programmatic API keys for server-side calls, and JWT bearer tokens for dashboard-style and user-facing flows.

API Keys (server-to-server)

Pass your key in the Authorization header on every request:

HTTP HEADER

Authorization: Bearer tv_live_sk_YOUR_PRODUCTION_KEY

Key type	Prefix	Use case	Data
Test key	tv_test_sk_…	Development & CI	Synthetic only
Live key	tv_live_sk_…	Production	Real PII, billed

JWT Bearer (dashboard flows)

Short-lived JWTs are issued via POST /auth/token and are scoped to a single tenant. Suitable for server-rendered dashboards or compliance portals where you need user-level audit trails.

CURL — Exchange credentials for JWT

curl -X POST https://api.trustverify.co.uk/auth/token \
  -H "Content-Type: application/json" \
  -d '{
    "clientId":  "YOUR_CLIENT_ID",
    "grantType": "client_credentials"
  }'
# Returns: { "accessToken": "eyJ…", "expiresIn": 3600, "tokenType": "Bearer" }

Signed-state OAuth

For third-party integrations, TrustVerify supports OAuth 2.0 with a signed state parameter to prevent CSRF. Your redirect URI must be registered in the Developer Console.

Never expose API keys client-side. All API key calls must originate from your backend. Use short-lived JWTs for any browser or mobile client flows. Rotate compromised keys immediately from the Console.

Every response includes X-RateLimit-Remaining so you can monitor quota consumption per request. See Rate Limits for full header documentation.