Authentication

API keys

The API uses bearer API keys minted from the developer console. Send the key as:

Authorization: Bearer bdx_live_...

Clients that cannot set a custom Authorization header may send X-API-Key: bdx_live_... instead. Both are accepted identically.

Keep a key on your server only. Do not place it in browser JavaScript, a mobile binary, a public repository, or a shared URL. Revoke a key from the console at any time; revocation takes effect within about a minute.

Sandbox vs live keys

The console mints two kinds of keys:

• Live keys (bdx_live_...) can call /v1. You can hold up to 5 active live keys per account.
• Sandbox keys (bdx_sbx_...) are for testing console integration only. A sandbox key against /v1 gets 403 sandbox_key.

Missing or invalid keys

• No key, or a malformed key: 401 unauthorized.
• A revoked or unrecognized key: 401 unauthorized.
• A valid sandbox key: 403 sandbox_key.

Every error uses the application/problem+json envelope from rate limits and errors.

Open signup

Anyone can create a free developer account and a live key from the console; there is no waitlist or manual approval step. See rate limits and errors for the free tier limits.