Authentication

Protected The Wo endpoints use API key authentication. Authentication is a shared platform capability. Individual products can use this same mechanism without redefining API key behavior inside each product. Operational Evidence and Trade Document use this authentication model for their protected product operations. Operational Evidence also uses it for current-usage visibility.

Create an API key

Create and manage API keys in the Developer Console API Keys page, after you have a Workspace and access to the relevant product. The raw key is shown as secret credential material; store it securely because the API key list cannot recover its value later. Send your API key through the following HTTP header:

x-api-key: <your-api-key>

For example:

POST /v1/documents/extract
content-type: application/json
x-api-key: <your-api-key>

API keys are secrets

An API key authenticates your integration and must be treated as a secret credential. Do not:

commit API keys to source control;
include API keys in public documentation;
include API keys in screenshots;
send API keys through query parameters;
write raw API keys to ordinary application logs;
embed API keys in publicly distributed frontend code;
embed API keys in publicly distributed mobile applications.

The current API key model is intended for trusted server-to-server integrations. Store the credential in a server-side secret manager or environment variable appropriate for your deployment environment.

Missing API key

Requests to protected endpoints without the x-api-key header are rejected before the business operation is executed. Example response:

HTTP/1.1 401 Unauthorized
content-type: application/json

{
  "error": {
    "code": "missing_api_key",
    "message": "The x-api-key header is required.",
    "requestId": "req_123"
  }
}

Invalid API key

Invalid, inactive, or revoked credentials are represented through the same public error. This prevents API consumers from learning the internal lifecycle state of a credential. Example:

HTTP/1.1 401 Unauthorized
content-type: application/json

{
  "error": {
    "code": "invalid_api_key",
    "message": "The provided API key is invalid.",
    "requestId": "req_123"
  }
}

Authentication service unavailable

If the API cannot safely validate a credential because the authentication service is temporarily unavailable, the request fails closed.

HTTP/1.1 503 Service Unavailable

The public error code is:

api_key_authentication_unavailable

The protected operation is not executed when authentication cannot be completed reliably.

Request IDs

Error responses include a requestId. Keep this value when reporting an integration problem because it can be used to correlate the failed request without exposing the API key itself.

Next steps

Review Operational Evidence product access.
Follow the Operational Evidence Quickstart.
Review Trade Document product access and its Quickstart.

Start here

Shared platform

Authentication

Authentication

Create an API key

API keys are secrets

Missing API key

Invalid API key

Authentication service unavailable

Request IDs

Next steps

​Authentication

​Create an API key

​API keys are secrets

​Missing API key

​Invalid API key

​Authentication service unavailable

​Request IDs

​Next steps

Authentication

Create an API key

API keys are secrets

Missing API key

Invalid API key

Authentication service unavailable

Request IDs

Next steps