Authentication

Privy issues each merchant one API key for each environment. Send the key in the X-API-Key header for these back-channel operations:

• Create a verification session.
• Exchange a result code for a verified-data JWT.

Code
X-API-Key: <MERCHANT_API_KEY>

Keep the API key on the merchant backend. Do not put the API key in a browser, iframe, WebView, or mobile application.

The JWKS and health endpoints are public. They do not use the API key.

API keys are specific to the sandbox or production environment. See Environments.

The merchant credentials are the API key and, with the Identity package, the RSA private key. See Encrypted Identity Data.