Authentication
AuthSetu uses API Keys to authenticate requests. You can manage your API keys in the AuthSetu Dashboard under Application Settings > API Keys.
API Key Types
| Type | Prefix | Usage |
| :------------------ | :------- | :------------------------------------------------------------------------------------------------- |
| Publishable Key | pk_... | Used in client-side SDKs (JavaScript, Mobile). Limited to safe operations like login. |
| Secret Key | sk_... | Used in server-side integrations. Has full access to your project resources. Keep this secret! |
Authenticating Requests
To authenticate your requests, include your API key in the Authorization header as a Bearer token.
Example with cURL
curl -X GET "https://api.authsetu.com/api/v1/me" \
-H "Authorization: Bearer YOUR_SECRET_KEY" \
-H "Content-Type: application/json"Scopes
API keys can be restricted to specific scopes to follow the principle of least privilege. Common scopes include:
project:read: View project configuration.
customer:write: Create or update customers.
audit:read: Access audit logs.
Never share your Secret Key or commit it to version control. If a key is compromised, revoke it immediately in the dashboard.