AntifraudAI API Authentication: Keys and Best Practices

AntifraudAI authenticates every API request using API keys — long-lived secret tokens that identify your account and authorize access to the API. API keys are created and managed from the AntifraudAI dashboard at app.antifraudai.com. You can create multiple keys (for example, one per environment or service), restrict each key’s permissions, and revoke any key instantly if it’s ever compromised.

Store your API keys in environment variables (e.g., ANTIFRAUDAI_API_KEY) and read them at runtime. Never hardcode keys directly in source code or check them into version control — even in private repositories.

Creating an API Key

Log in to the dashboard at app.antifraudai.com.
Navigate to Settings → API Keys.
Click Create New Key.
Enter a descriptive label so you can identify the key later (e.g., production-backend, ci-pipeline).
Select the desired permission level (see Key Permissions below).
Click Generate and copy the key immediately.

API keys are shown in full only once at creation time. After you navigate away, only the last four characters are displayed. If you lose a key, generate a new one and rotate it into your integration. Keys are prefixed to indicate their environment:

Prefix	Environment
`sk_test_`	Sandbox — safe for development and testing
`sk_live_`	Production — used for live traffic

Using Your API Key

Pass your API key as a Bearer token in the Authorization header of every request:

Authorization: Bearer sk_live_xxxxxxxxxxxxxxxxxxxx

curl -X POST https://api.antifraudai.com/v1/transactions/screen \
  -H "Authorization: Bearer sk_live_xxxxxxxxxxxxxxxxxxxx" \
  -H "Content-Type: application/json" \
  -d '{"amount": 99.00, "currency": "USD", "user_id": "usr_abc123"}'

import requests
import os

headers = {
    "Authorization": f"Bearer {os.environ['ANTIFRAUDAI_API_KEY']}",
    "Content-Type": "application/json",
}

response = requests.post(
    "https://api.antifraudai.com/v1/transactions/screen",
    json={"amount": 99.00, "currency": "USD", "user_id": "usr_abc123"},
    headers=headers,
)
print(response.json())

const response = await fetch(
  "https://api.antifraudai.com/v1/transactions/screen",
  {
    method: "POST",
    headers: {
      "Authorization": `Bearer ${process.env.ANTIFRAUDAI_API_KEY}`,
      "Content-Type": "application/json",
    },
    body: JSON.stringify({
      amount: 99.00,
      currency: "USD",
      user_id: "usr_abc123",
    }),
  }
);

const data = await response.json();
console.log(data);

Key Permissions

When creating an API key, you choose its permission level. Use the most restrictive level that meets your integration’s needs.

Permission	Capabilities	Recommended For
Read-Only	Retrieve decisions, fetch event history, query cases, read configuration	Dashboards, reporting services, audit tools
Read-Write	All read-only actions, plus: screen transactions, create/update rules, manage cases, configure webhooks	Backend servers, fraud engines, operational integrations

You cannot upgrade a key’s permissions after creation — create a new key with the required level and retire the old one.

Rotating Keys

Regularly rotating API keys is a security best practice and is essential if a key is ever exposed. Follow these steps to rotate a key with zero downtime:

Create a new key — In Settings → API Keys, create a new key with the same permission level as the key you’re replacing.
Deploy the new key — Update your application’s environment variable (or secrets manager) to use the new key and deploy the change.
Verify the new key is active — Confirm your integration is successfully authenticating with the new key by checking recent API logs in the dashboard.
Delete the old key — In Settings → API Keys, locate the old key and click Revoke.

Deleted (revoked) keys are immediately and permanently invalidated. Any service still using the old key will begin receiving 401 Unauthorized errors the instant the key is revoked. Ensure your new key is fully deployed and verified before revoking the old one.

Authentication Errors

If a request fails due to an authentication or authorization problem, the API returns one of the following HTTP error codes:

HTTP Status	Error	Cause & Resolution
`401 Unauthorized`	`missing_or_invalid_credentials`	The `Authorization` header is absent, malformed, or contains an invalid key. Verify the header format is `Bearer <key>` and that the key value is correct and hasn’t been revoked.
`403 Forbidden`	`insufficient_permissions`	The API key is valid but does not have the required permissions for this endpoint. Verify the key’s permission level and create a read-write key if needed.
`429 Too Many Requests`	`rate_limit_exceeded`	The key has exceeded its request quota for the current window. Implement exponential back-off and retry logic. See the Rate Limits page for quota details.

All error responses follow a consistent JSON structure:

{
  "error": {
    "code": "missing_or_invalid_credentials",
    "message": "The Authorization header is missing or contains an invalid API key.",
    "status": 401
  }
}

Get Started

Core Concepts

Guides

Configuration

Help

AntifraudAI API Authentication: Keys and Best Practices

Creating an API Key

Using Your API Key

Key Permissions

Rotating Keys

Authentication Errors

​Creating an API Key

​Using Your API Key

​Key Permissions

​Rotating Keys

​Authentication Errors

Creating an API Key

Using Your API Key

Key Permissions

Rotating Keys

Authentication Errors