Authentication

Workspace endpoints require a workspace API key in the Authorization header:

Authorization: Bearer vc_...

Keys are created in the dashboard at app.verifycate.com (Workspace → API Keys). The secret starts with vc_ and is shown only once when created.

Requirements

• The key must belong to the workspace in the path (/workspaces/{slug}/...).
• The workspace must have an active Pro seat. Unseated keys are rejected with 402 and code seat_required.
• Scopes on the key must allow the method and path — see Scopes.

What not to use

Do not send dashboard session cookies or user JWT access tokens for these workspace API routes. The developer API is keyed authentication only.

Public endpoints

These routes need no Authorization header:

• GET /api/v1/certificates/{publicID}
• GET /api/v1/certificates/{publicID}/verify
• GET /api/v1/certificates/{publicID}/credential.json

See Verify.