Authentication
Your server authenticates with a secret API key. The mobile app never holds one: it gets a capture token that opens a single session.
auth-header
curl https://api.warka-iq.com/v1/usage --header "Authorization: Bearer wv_live_..."API keys
- Create keys in the console. The full key is shown once and can't be recovered.
- Warka stores only a keyed hash.
- Give each key only the scopes it needs. Rotate or revoke at any time.
- Never put a key in a mobile app, browser code or a repository.
Scopes
| Scope | Allows |
|---|---|
| identities:read | Read identities |
| identities:write | Enroll, update and delete identities |
| sessions:write | Create capture sessions |
| verify:write | Run verifications |
| verifications:read | Read verification results |
| usage:read | Read usage and quotas |