Skip to content
BrazID

Authentication

Send your key in the x-api-key header on every request. With no header, or with an invalid or revoked key, the API answers 401 and does not charge.

You create and revoke keys in the dashboard. A revoked key stops working immediately.

Keeping keys safe

  • Use the key only on your server. Never put it in browser code, mobile apps or repositories.
  • Create one key per system and use sandbox keys for testing, so you can revoke one without affecting the others.
  • If you suspect a leak, revoke the key in the dashboard and create another.

HTTP

1GET /v1/me HTTP/1.12Host: api.brazid.com3x-api-key: brz_live_••••••••••••••••

401 Unauthorized

1{2 "error": "Invalid or missing API key"3}