Authorization

Authenticate VOVE ID API requests with a private API key.

VOVE ID server APIs use a private API key in the x-api-key request header.

Authentication header

GET https://api.voveid.net/v2/users/customer-7f3d
x-api-key: vove_sandbox_replace_me
accept: application/json

Header	Required	Description
x-api-key	Yes	Private API key for the selected environment
content-type	For JSON bodies	Use application/json
accept	Recommended	Use application/json

The key determines the organization and environment available to the request. A Sandbox key cannot access Production resources.

Server-side example

const response = await fetch('https://api.voveid.net/v2/users/customer-7f3d', {
  headers: {
    accept: 'application/json',
    'x-api-key': process.env.VOVE_API_KEY,
  },
});

if (!response.ok) {
  throw new Error(`VOVE request failed (${response.status})`);
}

Key handling

• Store API keys in a secret manager or protected server environment variable.

• Never put a private API key in browser JavaScript, a mobile application, a public repository, a URL, or a screenshot.

• Never log the key or include it in analytics, crash reports, or support attachments.

• Use separate credentials for Sandbox and Production.

• Rotate the key immediately when exposure is suspected.

Client SDKs do not use this private key. They use a public SDK key and session token.

Authentication errors

Status	Meaning	Action
401	The API key is missing or invalid	Check secret injection and environment; do not retry blindly