API Authentication

The VeilForms API uses Bearer token authentication. All API requests must include your API key in the Authorization header.

Getting Your API Key

1. Log in to your VeilForms Dashboard
2. Navigate to Settings → API Keys
3. Click Generate New Key
4. Copy and securely store your key

Making Authenticated Requests

Include your API key in the Authorization header:

curl https://veilforms.com/api/forms \
  -H "Authorization: Bearer vf_live_abc123xyz789"

JavaScript Example

const response = await fetch('https://veilforms.com/api/forms', {
  headers: {
    'Authorization': 'Bearer vf_live_abc123xyz789',
    'Content-Type': 'application/json'
  }
});

const data = await response.json();

Python Example

import requests

headers = {
    'Authorization': 'Bearer vf_live_abc123xyz789',
    'Content-Type': 'application/json'
}

response = requests.get('https://veilforms.com/api/forms', headers=headers)
data = response.json()

API Key Types

Test keys only access test-mode forms and don’t affect production data.

Key Permissions

API keys can be scoped to specific permissions:

Default keys have all permissions. Create restricted keys for specific integrations.

Rate Limits

Rate limit headers are included in all responses:

X-RateLimit-Limit: 300
X-RateLimit-Remaining: 299
X-RateLimit-Reset: 1699920000

Error Responses

401 Unauthorized

{
  "error": "unauthorized",
  "message": "Invalid or missing API key"
}

403 Forbidden

{
  "error": "forbidden",
  "message": "API key does not have permission for this action"
}

429 Too Many Requests

{
  "error": "rate_limited",
  "message": "Rate limit exceeded",
  "retry_after": 60
}

Security Best Practices

1. Never expose API keys in client-side code — Use server-side requests only
2. Use environment variables — Don’t hardcode keys in source code
3. Rotate keys regularly — Generate new keys periodically
4. Use minimum permissions — Create scoped keys for specific integrations
5. Monitor usage — Check API logs for unexpected activity

Revoking Keys

To revoke an API key:

1. Go to Settings → API Keys in your dashboard
2. Find the key to revoke
3. Click Revoke

Revoked keys are immediately invalidated. All requests using that key will return 401 Unauthorized.