Authentication and Environments

JSON over HTTPS. A single secret token header authenticates every call.

Cowork provides separate sandbox and production (live) environments, each with its own base URL and credentials shown in the workspace. Sandbox uses test data and is not billed; production runs real checks against authoritative sources and is billed. Never use a sandbox key against production or vice versa.

Authentication is a single header on every server-to-server request. There is no separate OAuth handshake; possession of the secret key is authority, so it must never leave your backend.

Credential	Where used	Notes
API secret key	Server-to-server, token header	Never expose client-side. Authority = possession.
Public merchant key	Web/mobile SDKs, hosted flows	Client-safe; scoped to liveness/document-capture session start.

Environment	Baseurl	Purpose	Data
Sandbox	https://api.sandbox.youverify.co	Integration & testing	Test data, not billed
Production (live)	https://api.youverify.co	Real checks	Authoritative sources, billed

API conventions

• Format: JSON over HTTPS on every request and response.

• Identifiers: entities carry a stable ent_… ID; other objects carry their own IDs.

• Response envelope: every response shares one shape, so you write your client once. { "success": true, "status_code": 200, "message": "…", "data": { }, "links": [] }

• Errors: same skeleton with success: false, a statusCode, and a machine-readable name (e.g. ResourceNotFoundError).

• Pagination: list endpoints support offset paging; high-volume streams (for example signals) also offer cursor pagination, preferred for production polling.