Authentication

Vault supports API key authentication (server-to-server) and JWT authentication (dashboard and management). POST /tokenize requires X-Pub-Key when using a production vault API key; test/sandbox API keys do not require it. Some requests support hybrid (API key + JWT for user attribution).

API key

Header: X-API-Key: <your_api_key> Use for: Tokenization, proxy, verify key. For POST /tokenize you must also send X-Pub-Key when using a production vault API key. Test/sandbox API keys do not require X-Pub-Key. Endpoints that accept API key:

Endpoint	Permission
POST /tokenize	tokenization (+ X-Pub-Key for production keys)
POST /proxy/transaction	tokenization
POST /test-tokens	tokenization (+ X-Pub-Key for production keys)
GET /api/applications/key	any (verify key)

API key format may vary (e.g. provisioned keys); docs often show keys starting with key_ as an example. Never expose API keys in client-side code.

JWT

Header: Authorization: Bearer <jwt> or cookie (after login). Use for: Dashboard and management — projects, applications, audit logs, user settings, MFA. JWT is required for management endpoints (projects, applications, audit logs, token management, user settings); Applications also documents the verify-key endpoint (API key).

Auth endpoints (explicit paths)

Method	Path	Description
POST	/auth/login	Email/password login, returns JWT
POST	/auth/logout	Log out
GET	/auth/verify	Validate current JWT
POST	/auth/change-password	Body: current_password, new_password (JWT)
POST	/auth/forgot-password	Body: email
GET	/auth/verify-reset-token	Query: token
POST	/auth/reset-password	Body: token, new_password
POST	/auth/reset-expired-password	Body: token, current_password, new_password
GET	/auth/password-expiry-info	JWT
POST	/auth/send-verification-code	Email verification flow
POST	/auth/verify-email-code	Verify email code
POST	/auth/register	Registration (when email verification used)
POST	/auth/mfa/verify	Body: code
POST	/auth/mfa/verify-backup	Backup code
POST	/auth/mfa/disable	Body: code
GET	/auth/mfa/status	MFA status
GET	/auth/mfa/verify-page	MFA verify page
GET	/mfa-status	Root path for MFA status

MFA setup is via POST /user/settings/mfa (toggle/setup); response can include totp_uri and backup_codes when enabling. There is no separate /auth/mfa/setup path.

Hybrid

Send both X-API-Key and Authorization: Bearer <jwt>. The API key authorizes the request; the JWT identifies the user for audit logging (e.g. on tokenize or proxy).

Verify API key

See GET /api/applications/key to validate a key and read its project and permissions.

Base URL

Use the Vault base URL (sandbox or production).

​API key

​JWT

​Auth endpoints (explicit paths)

​Hybrid

​Verify API key

​Base URL

API key

JWT

Auth endpoints (explicit paths)

Hybrid

Verify API key

Base URL