Skip to main content
Authmatech uses API-key authentication. The OpenAPI security scheme is ApiKey, an API key passed in the X-API-KEY header, accompanied on every operation by the X-CLIENT-ID header that identifies your account.

​
Required headers

HeaderRequiredDescription
X-API-KEYYesYour secret API key. Server-side only.
X-CLIENT-IDYesYour Client ID, identifying the account.
Content-TypeFor bodiesapplication/json
curl -X POST https://service.authmatech.com/v1/api/verify \
  -H "X-API-KEY: YOUR_API_KEY" \
  -H "X-CLIENT-ID: YOUR_CLIENT_ID" \
  -H "Content-Type: application/json" \
  -d '{ "mobileNumber": "+962791234567", "encryptedMobileNumber": "…", "operatorId": "ZAIN_JO", "serviceType": "LOGIN" }'

​
Credential scopes

CredentialHeaderAllowed endpoints
API keyX-API-KEYAll server APIs under /v1/api/**
SDK tokenX-SDK-TOKENOnly /v1/api/sdk/session
The SDK token cannot call Verify or any other server API — it exists so client code never holds your API key. Use it from the Web SDK and mobile SDKs only.

​
Unauthorized response

A missing or invalid X-API-KEY / X-CLIENT-ID returns 401 in the standard envelope: 
{
  "success": false,
  "messages": [
    { "type": "FAILURE", "message": "Unauthorized", "httpStatus": "UNAUTHORIZED" }
  ],
  "data": null
}

​
Rotating keys

  • POST /v1/api/me/api-key/rotate — rotate your own key (requires the client secret). See Rotate an API key.
  • POST /v1/api/me/api-key/generate — generate your first key. See Generate an API key.
For security best practices, see the Authentication guide.