Authentication

Authenticated Gateway operations use a tenant API key in the HTTP Authorization header. Keep the key in backend configuration or a secret manager. Never send it to a browser, wallet, URL, source repository, or client-side storage.

text

Authorization: Bearer YOUR_API_KEY

Use a scoped key with only the permissions required by the integration. The GET /v1/auth/whoami operation returns non-secret metadata about the key used for the request and does not grant additional permissions.

Wallet-facing OID4VP request and response endpoints are public protocol endpoints and do not use the tenant API key. The relying-party backend uses its API key to create, read, and delete sessions; the wallet follows the session protocol URLs without receiving that key.

If a request returns 401, check that the key is present, active, and sent to the correct Gateway environment. A 403 means the key is recognized but does not have the required scope or tenant permission.