API key
Header:X-API-Key: <your_api_key>
Use for: Tokenization, proxy, verify key. For POST /tokenize you must also send X-Pub-Key (get from dashboard or config).
Endpoints that accept API key:
| Endpoint | Permission |
|---|---|
| POST /tokenize | tokenization (+ X-Pub-Key required) |
| POST /proxy/transaction | tokenization |
| POST /test-tokens | tokenization (+ X-Pub-Key) |
| GET /api/applications/key | any (verify key) |
key_ as an example. Never expose API keys in client-side code.
JWT
Header:Authorization: Bearer <jwt> or cookie (after login).
Use for: Dashboard and management — projects, applications, audit logs, user settings, MFA. JWT is required for management endpoints (projects, applications, audit logs, token management, user settings); Applications also documents the verify-key endpoint (API key).
Auth endpoints (explicit paths)
| Method | Path | Description |
|---|---|---|
| POST | /auth/login | Email/password login, returns JWT |
| POST | /auth/logout | Log out |
| GET | /auth/verify | Validate current JWT |
| POST | /auth/change-password | Body: current_password, new_password (JWT) |
| POST | /auth/forgot-password | Body: email |
| GET | /auth/verify-reset-token | Query: token |
| POST | /auth/reset-password | Body: token, new_password |
| POST | /auth/reset-expired-password | Body: token, current_password, new_password |
| GET | /auth/password-expiry-info | JWT |
| POST | /auth/send-verification-code | Email verification flow |
| POST | /auth/verify-email-code | Verify email code |
| POST | /auth/register | Registration (when email verification used) |
| POST | /auth/mfa/verify | Body: code |
| POST | /auth/mfa/verify-backup | Backup code |
| POST | /auth/mfa/disable | Body: code |
| GET | /auth/mfa/status | MFA status |
| GET | /auth/mfa/verify-page | MFA verify page |
| GET | /mfa-status | Root path for MFA status |
totp_uri and backup_codes when enabling. There is no separate /auth/mfa/setup path.
Hybrid
Send bothX-API-Key and Authorization: Bearer <jwt>. The API key authorizes the request; the JWT identifies the user for audit logging (e.g. on tokenize or proxy).