Authentication

Attesso authenticates your backend with an environment-scoped API key in the HTTP Authorization header.

Authorization: Bearer att_test_...

Keep keys server-side

API keys belong only in your backend’s secret store. Never expose them to:

An Attesso API key represents your organization. Anyone holding it can act through the authenticated server interface within that environment.

Prefix	Environment	Base URL
`att_test_...`	Staging	`https://api-staging.attesso.com`
`att_live_...`	Production	`https://api.attesso.com`

Use separate secret entries and deployment configuration for each environment. Do not silently fall back from production to staging or the reverse.

Read a key without placing it in shell history:

export ATTESSO_API_URL="https://api-staging.attesso.com"
read -r -s "ATTESSO_API_KEY?Paste your test key: "
export ATTESSO_API_KEY

Remove it when the session ends:

unset ATTESSO_API_KEY

Treat the raw key as unrecoverable after initial display.

Create a replacement

Store the replacement in your secret manager before changing deployed configuration.

Verify the replacement

Make a safe staging request and confirm the expected organization and environment behavior.

Deploy the replacement

Update server-side configuration without exposing the value in logs.

Revoke the old key

Confirm the replacement is active before removing the historical credential.

A missing or invalid key returns 401. Treat authentication failures as non-retryable until configuration changes.