Authentication

Every User Verification v2 request requires two authentication mechanisms and the Privy-Version header:

1. HTTP Basic authentication with the username and password supplied by Privy.
2. The confidential merchant key in the Merchant-Key header.

Code
Authorization: Basic <BASE64_USERNAME_AND_PASSWORD>
Merchant-Key: <MERCHANT_KEY>
Privy-Version: 2026-08-17.heimdall

Most HTTP clients can create the Basic authorization value for you. For example, cURL uses -u '<username>:<password>'.

Keep the username, password, and merchant key on the merchant backend. Do not put them in browser code, a mobile application, logs, or source control.

Both credentials and Privy-Version: 2026-08-17.heimdall are required in the same request. Invalid Basic credentials or an invalid merchant key return HTTP 401. A valid merchant that does not have access to the feature or channel, or has insufficient balance, receives HTTP 403.