How do I authenticate requests?

Pass your API key as a Bearer token in the Authorization header: Authorization: Bearer vat_live_…. The authentication guide has full request examples and the error responses for a missing or revoked key. You manage keys – creating, naming, and revoking them – entirely from the dashboard. Never expose a live key in client-side code; keep it server-side.

A complete request

curl https://api.vatnode.dev/v1/vat/IE6388047V -H "Authorization: Bearer vat_live_your_key_here"

Every request to the validation endpoint needs a key. Test keys (vat_test_…) authenticate the same way.

When authentication fails

A failed request returns 401 with an error object that carries a code, a message and a requestId:

• UNAUTHORIZED – no usable key was sent. The message tells you to include Authorization: Bearer {your_api_key}.
• INVALID_API_KEY – the key was sent but is not accepted: it is wrong or has been revoked.

Managing keys

In Dashboard > API Keys you create a key by giving it a label, and each key shows its label, a preview, its environment, when it was last used and when it was created. The full key is shown only once, at creation, so copy it then. Deleting a key is permanent and immediate: any application still using it loses access.

Keeping keys safe

• Read the key from an environment variable such as VATNODE_API_KEY; never commit it.
• Call vatnode from your server. A key in browser code is visible to every visitor.
• Use a separate key per environment and application, so a compromised one can be revoked on its own.
• To rotate: create a new key, deploy it, check that it works, then delete the old one.

See the errors reference for the other status codes the API can return.