Authentication & Access Control
Learn how to authenticate requests to the VeriLens API using API Keys or JWT session tokens.
Dual Authentication Modes
VeriLens enforces strict role-based access control with two authentication paradigms tailored for different client types:
1. API Key Authentication (Developer Services)
API keys are strings prefixed with `vl_live_` generated in the User Dashboard. Include your key in the `Authorization` HTTP header:
Key Characteristics
Authorization: Bearer vl_live_a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5p62. JWT Dual-Token Authentication (Web & Mobile Apps)
Web and mobile clients authenticate using standard JSON Web Tokens: • **Access Token**: Short-lived (`15 minutes`). Sent in `Authorization: Bearer <access_token>`. • **Refresh Token**: Long-lived (`7 days`). Sent to `/api/v1/auth/refresh` to rotate tokens silently. • **Reuse Detection**: Reusing an invalidated refresh token automatically triggers security revocation of all active user sessions.
Permitted vs. Restricted Routes
For security, API keys cannot access sensitive administrative or financial endpoints:
| Feature Group | Endpoints | Auth Accepted | Behavior with API Key |
|---|---|---|---|
| Fact-Checking | /api/v1/predict/* | JWT or API Key | Draws from account credits |
| History | /api/v1/predictions | JWT or API Key | Returns owner's history |
| API Key Management | /api/v1/api-keys/* | JWT Only | Returns 403 Forbidden |
| Payments & Invoices | /api/v1/payments/* | JWT Only | Returns 403 Forbidden |
| User Profile | /api/v1/auth/me | JWT Only | Returns 403 Forbidden |