# Authentication

Every User Verification v2 request requires two authentication mechanisms and
the `Privy-Version` header:

1. HTTP Basic authentication with the username and password supplied by Privy.
2. The confidential merchant key in the `Merchant-Key` header.

```http
Authorization: Basic <BASE64_USERNAME_AND_PASSWORD>
Merchant-Key: <MERCHANT_KEY>
Privy-Version: 2026-08-17.heimdall
```

Most HTTP clients can create the Basic authorization value for you. For
example, cURL uses `-u '<username>:<password>'`.

> Keep the username, password, and merchant key on the merchant backend. Do not
> put them in browser code, a mobile application, logs, or source control.

Both credentials and `Privy-Version: 2026-08-17.heimdall` are required in the
same request. Invalid Basic credentials or an invalid merchant key return HTTP
`401`. A valid merchant that does not have access to the feature or channel,
or has insufficient balance, receives HTTP `403`.