Authentication

API keys

Create keys in the Console → API Keys (verified business accounts only). Each key gives you two secrets, shown once at creation:

API key

anonage_sk_… — identifies your account on the verification endpoints. Send it as the X-API-Key header.

Signing secret

whsec_… — used to verify the HMAC signature on callbacks. See Callbacks.

We store only a hash of your API key, so it can’t be recovered — if you lose it, revoke and create a new one.

Using your key

curl https://api.anonage.io/api/age-verification/session \
  -H "X-API-Key: anonage_sk_your_key" \
  -H "Content-Type: application/json" \
  -d '{ "age_required": 18, "callback_url": "https://shop.example/anonage/callback" }'

The API key is a server-side secret. Never ship it to the browser or a mobile app, and never put it in a QR code — open sessions from your backend and hand the browser only the opaque session_id + nonce.

Account vs key auth

Header	Used for	Auth
`X-API-Key: anonage_sk_…`	Verification endpoints (`/api/age-verification/*`)	Your merchant key
`Authorization: Bearer <jwt>`	Key management & usage (`/api/keys`, `/api/usage/*`)	Your dashboard session

Rotating & revoking

Revoke a key in the Console at any time — sites using it stop verifying immediately. To rotate with zero downtime, create the new key, deploy it, then revoke the old one.

Roadmap: separate test and live keys (test keys run against sandbox and don’t bill), per-key allowed origins, and signing-secret rotation with a grace window.

Quickstart Callbacks

⌘I

Get started

Integrate

API keys

API key

Signing secret

Using your key

Account vs key auth

Rotating & revoking

​API keys

API key

Signing secret

​Using your key

​Account vs key auth

​Rotating & revoking

API keys

Using your key

Account vs key auth

Rotating & revoking