API Reference

The API reference is generated from Authbound’s OpenAPI specification. For the isolated testbed’s opt-in keyless HTTP flow, see the wallet testbed guide. The standard security schemes below continue to apply to production and ordinary staging.

Base URL

https://api.authbound.io

Secret-key requests

Server-side requests use your secret key in the X-Authbound-Key header.

curl https://api.authbound.io/v1/verifications \
  -H "Content-Type: application/json" \
  -H "X-Authbound-Key: sk_test_..." \
  -H "Idempotency-Key: verify-user-123" \
  -d '{
    "policy_id": "YOUR_POLICY_ID",
    "customer_user_ref": "user_123"
  }'

Client-token requests

Status requests use the verification clientToken plus your publishable key.

curl https://api.authbound.io/v1/verifications/vrf_123/status \
  -H "Authorization: Bearer <clientToken>" \
  -H "X-Authbound-Publishable-Key: pk_test_..."

Contract headers

Authbound SDKs and station BFF routes send these contract headers on Gateway requests:

Authbound-Api-Version: v1
Authbound-Contract-Revision: v1.2026-09-01.1

Use authboundContractHeaders() from @authbound/core when you call the REST API directly from custom server code.

Idempotency

Selected mutating endpoints accept Idempotency-Key, including credential-definition create and publish. Check the operation before sending the header. Idempotency results are retained for 24 hours.

Errors

Every error response has the same shape:

{
  "object": "error",
  "code": "invalid_key",
  "message": "Invalid or missing API key"
}

Branch on code, not message. See Errors for every code and how to fix it.

Overview

Generated endpoints

Base URL

Secret-key requests

Client-token requests

Contract headers

Idempotency

Errors

​Base URL

​Secret-key requests

​Client-token requests

​Contract headers

​Idempotency

​Errors

Base URL

Secret-key requests

Client-token requests

Contract headers

Idempotency

Errors