Authenticate your API requests

To make sure that any API requests for your account are really coming from you, you'll be asked to authenticate all requests by providing an API key associated with your account.

Get your API keys

You have two API keys: One for your demo account and one for your live account.

When you make a call to Passfort, you should send of these API keys in the header of your request. Send the API key for the account you're using at the time.

Use your demo account to try out features and test whether your configuration works as expected. With your live account, any profiles you create count toward your profiles under management, and you'll be charged for any checks you run.

To access your API keys, follow these steps once for your demo account and once for your live account:

Log into Passfort with your demo login details or your live login details.
Select the Manage account icon and choose API Key.
Your API keys for the account you logged into are displayed. By default, there's a Master API key displayed under [Your company name] Master API Key.

If you're integrating with multiple systems, for example, a CRM and a transaction monitoring system, you should also follow the steps to issue one new API key for every system. You should do this for your demo account and your live account. If you're using allow listing, only allow listed IP addresses should have access to your master key.

Make a test API call

To check that you can use your API keys successfully, try making a call with each key to see if you get responses without errors.

In the header of each request you make, include a parameter called apikey with the value of the key you want to test.

For example: "apikey": "adc5788e3b7fecc161d2a36916750ee10480a8c75841bd"

This example is not a real API key, so it's not possible to use it to make calls.

To run your test, make the call to the following endpoint once per key. The call returns the name of your API key and your institution.

Request endpoint:

GET https://api.passfort.com/4.0/whoami

Sample response:

{
    "auditee_name": "Forexo Ltd Master API Key",
    "institution": {
        "id": "6bba3592-d9de-1ee5-8e97-ba8d8d13c558",
        "logo_url": null,
        "name": "Forexo Ltd"
    },
    "user": null
}

If you received a response with the API key name as the value for auditee_name, the test worked.

If you received an error message, check that you're sending a valid API key in the header of your request, and try again.

In this section:

Using Passfort