Authentication
One header, two environments, and scopes that decide what you may call.
Send your credential in an X-API-Key header on every request. There is no token exchange and nothing to refresh.
curl https://api.example.com/api/v1/integration/workflows \
-H "X-API-Key: pmt_live_..."Sandbox and production
| Prefix | Environment | What it does |
|---|---|---|
| pmt_test_ | Sandbox | Contacts no provider, is never charged, and keeps working even if the account is unfunded. |
| pmt_live_ | Production | Real verifications, funded and counted against your plan. |
Scopes
A credential holds a set of scopes chosen when it was issued, bounded by what your institution's plan includes. There is no wildcard. GET /me reports the scopes you actually hold.
| Scope | Unlocks |
|---|---|
| workflows.read | List work flows and read the fields they collect |
| sessions.create | Open verification sessions |
| sessions.read | Read sessions and their status |
| sessions.cancel | Cancel sessions |
| cases.read | Read the case register, a case, and its status history |
| decisions.read | Read decisions and non-sensitive collected data |
| decisions.read.sensitive | Also read sensitive collected data |
| usage.read | Read your own usage |
| services.SERVICE_KEY | Call that one service directly, e.g. services.FACE_MATCH |
Keeping a credential safe
- The secret is shown once, when it is issued. It is not stored anywhere you can read it back, and no permission can produce it.
- Send it in the header only. Never in a query parameter, a path, or a browser.
- Revoking a credential takes effect on the next call, and leaves your other credentials working.
- Rotating issues a replacement and kills the old secret immediately: there is no overlap period, so plan the cut-over.