Authentication

GoodVat authenticates server-to-server API requests with a single API key, passed as a Bearer token. This page covers how keys work, how they’re scoped to products, and how to send them correctly.

API key format

Keys look like this:

gv_live_7Kx2mPqR9sTvW4nJ8hL3bC6dF1gY0aZeXuN5oQiT

The prefix (gv_live_) identifies the environment the key belongs to, followed by 43 characters of cryptographically random entropy generated from a secure random source. Keys are stored server-side as a hash, never in plaintext — the raw key is shown to you exactly once, at creation time, in your Dashboard. If you lose it, you can’t retrieve it again; you’ll need to create a new one.

Creating a key

Create and manage keys from the API Keys page in your dashboard. Each key gets a human-readable name (e.g. "CI Pipeline Key") so you can tell them apart, and an optional expiry — set one if the key is for a short-lived job, or leave it non-expiring for long-running integrations.

Product access

A key works for every product your organization is subscribed to. Subscriptions are activated by our team during onboarding: get in touch (or use Get in touch with our team on the Products page of your dashboard) and we’ll set up your account. Once it’s active, every key in your org works against that product’s endpoints, with no per-key setup.

You can create keys before then, but until your organization’s subscription is active, requests return 403 Forbidden, even with a valid key.

Sending the key

Pass the key as a Bearer token in the Authorization header:

Authorization: Bearer gv_live_7Kx2mPqR9sTvW4nJ8hL3bC6dF1gY0aZeXuN5oQiT

Common responses

Status	Meaning
`401 Unauthorized`	API key is present but invalid, expired, or revoked.
`403 Forbidden`	`Authorization` header missing or malformed, the key lacks the permission the endpoint needs, or your organization’s subscription isn’t active yet.