Server-to-server authentication
The B2B API uses the X-API-Key header. The key determines the Tenant and environment; sending another organization’s identifier cannot change that scope. API credentials are separate from Portal login and browser session tokens.
X-API-Key: REPLACE_ON_YOUR_SERVERProtect the secret
- Store the key in a secrets manager or protected server configuration.
- Never include it in public JavaScript, URLs, distributed applications, repositories or support tickets.
- Log only necessary operational data. Redact headers and personal data.
- Separate credentials and configuration by environment. Grant only the permissions your integration needs.
If you suspect exposure, stop using the compromised key, coordinate revocation and replacement with the environment owner and confirm that consumers have switched to the new credential. Rotation should not require changing the verified person’s application.
Diagnose access errors
401 can mean a missing, invalid, revoked or environment-incompatible key. Depending on the operation, 403 can also indicate a disabled environment, insufficient permissions or an unauthorized IP. Do not retry these failures indefinitely.
Downloads require separate authorization; access to a transaction does not automatically grant access to its files. See documents and evidence and the error codes in the reference.