Skip to main content
Every Currents endpoint except GET /v1/health requires a bearer API key in the Authorization header.

​
Key format

Keys are environment-prefixed so they are obvious on sight in logs and tickets: Keys are 12 characters of prefix + 32 URL-safe base64 characters. They are returned exactly once at creation, then stored only as a SHA-256 hash on our side. Treat them like a password.
A leaked key allows full read/write to your tenant’s data. Rotate immediately by contacting your account contact.

​
Requesting a sandbox key

Email noreply@ventrasystems.com with the subject Currents Sandbox Access and include your operating entity name, intended use, and the email of the technical contact who will receive the key. You will receive:
  • One sandbox API key (cur_sk_test_…)
  • One webhook signing secret (used to verify our webhooks — see Webhooks)

​
Making an authenticated request

/v1/health is intentionally public — useful for connectivity checks before adding auth. Every other endpoint requires the header:

​
Failure modes

Every authentication failure is recorded against your tenant’s audit log with the reason, the partial key prefix, and the request ID returned in the response.