Authentication Planned
Every endpoint except ping will need an API key. This page describes how keys will work, so you can plan for them.
Keys are not issued yet. They come with the partner agreement; see Getting access.
Keys#
A key belongs to your organisation and comes in two kinds:
| Key | Starts with | Reaches |
|---|---|---|
| Test | wk_test_ |
Invented data only |
| Live | wk_live_ |
The members your agreement covers |
A test key never reaches live data, nor a live key test data; trying gives 403 mode_mismatch.
Sending a key#
Send the key in the Authorization header, on every request:
Shell
curl https://api.welly.no/v1/enrolments \
-H "Authorization: Bearer wk_test_…"A key in the query string is refused, so it never ends up in a log.
| Status | Code | When |
|---|---|---|
| 401 | key_missing |
No key was sent. |
| 401 | key_invalid |
The key is not one of ours. |
| 401 | key_revoked |
The key has been revoked. |
| 403 | permission_denied |
The key may not do this. |
Keeping keys safe#
- Keep keys on your server, in its secrets, never in a browser, an app or a repository.
- We store only a fingerprint of each key and show the key once, when it is made. If you lose it, you get a new one.
- If a key may have leaked, tell us. We revoke it at once and give you a new one.
- Every request made with a key is logged with its request id, so we can answer for it together.