Authentication

API keys

Create keys in the Dashboard → API Keys (verified business accounts only). Each key gives you two secrets, shown once at creation:

API key

anonage_sk_… — identifies your account on the verification endpoints. Send it as the X-API-Key header.

Signing secret

whsec_… — used to verify the HMAC signature on callbacks. See Callbacks.

We store only a hash of your API key, so it can’t be recovered — if you lose it, revoke and create a new one.

Using your key

curl https://api.anonage.io/api/age-verification/session \
  -H "X-API-Key: anonage_sk_your_key" \
  -H "Content-Type: application/json" \
  -d '{ "age_required": 18, "callback_url": "https://shop.example/anonage/callback" }'

The API key is a server-side secret. Never ship it to the browser or a mobile app, and never put it in a QR code — open sessions from your backend and hand the browser only the opaque session_id + nonce.

Header	Used for	Auth
`X-API-Key: anonage_sk_…`	Verification endpoints (`/api/age-verification/*`)	Your API key
`Authorization: Bearer <jwt>`	Usage & reporting (`/api/usage/*`)	Your dashboard session

Header

Used for

Auth

X-API-Key: anonage_sk_…

Verification endpoints (/api/age-verification/*)

Your API key

Authorization: Bearer <jwt>

Usage & reporting (/api/usage/*)

Your dashboard session

Test and live keys

Every key belongs to one environment, and says so in its own prefix:

Prefix	Environment	Behaviour
`anonage_sk_test_…`	Test	Free. Never billed, never counted against your usage limit.
`anonage_sk_live_…`	Live	Real verifications. Metered and billed.

Test keys need a verified email address. Live keys additionally require a verified identity on the account — your Dashboard walks you through both.

Get started

Transparency

Integrate

Plugins

API keys

API key

Signing secret

Using your key

Account vs key auth

Test and live keys

Rotating & revoking

​API keys

API key

Signing secret

​Using your key

​Account vs key auth

​Test and live keys

​Rotating & revoking

API keys

Using your key

Account vs key auth

Test and live keys

Rotating & revoking