API reference / authentication

Authentication

Keep SmartVerify tokens in a backend secret store. Browser applications should call your own backend.

Bearer authentication

Authorization: Bearer sv_live_REDACTED
Accept: application/json
Content-Type: application/json

Obtain credentials through SmartVerify account administration. Rotate on suspected exposure.

Send an X-Request-ID UUID for support correlation. Never use a real person’s identifier as a request ID.

Idempotency-Key: onboarding-case-8421-v1

Replaying the same key returns the existing request instead of creating a duplicate charge.

Use HTTPS, redact Authorization headers and keep tokens out of JavaScript, git, logs and issue reports.

Never

Put provider API keys, bearer tokens or database credentials in client-side code.