Authentication
API keys, header format, environment scoping, and CORS.
Every request to /service/* must include your API key in the X-API-Key header.
X-API-Key: cert_<prefix>_<secret>Key format
Keys are issued in the form cert_<prefix>_<secret>. The prefix is a public identifier (safe to log), the secret is sensitive and should be treated like a password.
Environment scoping
Keys are scoped to a single environment. A sandbox key cannot call production endpoints; a production key cannot call sandbox. Provision two separate keys.
Service scopes
Keys can be restricted to specific services: bankid, persondata, and company. A key with no scopes can call everything; a scoped key calling outside its scopes gets 403 insufficient_scope. Set scopes when creating the key in the dashboard.
Revocation
Revoking a key in the dashboard takes effect within seconds. Existing in-flight requests complete; new requests with a revoked key get 403 api_key_revoked.
Where to put the key
Keys are server-side only. Never embed them in browser-facing code, mobile apps, or public Git repos. If a customer-facing page needs to call Cerrtify, proxy through your own backend.
CORS
For browser-based callers, register allowed origins in the Cerrtify dashboard. Requests from unknown origins get 403 origin_not_allowed.