Skip to main content
Authenticate server-to-server requests with a bearer API key:

​
Keep keys server-side

Never expose an Attesso key to:
  • Browser or mobile bundles
  • End users or AI agents
  • Logs, traces, analytics, errors, issues, or chat
  • Source control
  • Command arguments recorded in shell history or process listings
The examples are copy-only. Never paste an Attesso API key into a browser-based tool or documentation form.

​
Read a test key safely

Remove it when the shell session ends:

​
Rotation

1

Create a replacement

Copy its one-time value directly into your backend secret store.
2

Verify the replacement

Make a safe test request before changing deployed configuration.
3

Deploy the replacement

Update the backend without exposing the value in logs.
4

Revoke the old key

Revoke only after the replacement is confirmed active.
Each organization may have at most two active keys per environment, allowing a short overlap during rotation. A missing or invalid key returns 401 and is not retryable until configuration changes.