Create an API key
curl --request POST \
--url https://app.sahlfinancial.com/api/v1/api-keys \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"name": "Back office (test)",
"scopes": [
"kyc:extract",
"kyc:verify"
]
}
'const options = {
method: 'POST',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({name: 'Back office (test)', scopes: ['kyc:extract', 'kyc:verify']})
};
fetch('https://app.sahlfinancial.com/api/v1/api-keys', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));import requests
url = "https://app.sahlfinancial.com/api/v1/api-keys"
payload = {
"name": "Back office (test)",
"scopes": ["kyc:extract", "kyc:verify"]
}
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text){
"key": {
"id": "9a2e6c4b-8d1f-4b57-9c3a-5e7f1d0b2a68",
"tenant_id": "0b6f5a3e-7c1d-4e0a-9d2f-3a1c5e8b7f10",
"name": "Back office (test)",
"prefix": "sk_test_Ab3d",
"scopes": "kyc:extract,kyc:verify",
"bound_identity": null,
"status": "active",
"last_used_at": null,
"expires_at": null,
"created_at": "2026-10-07T09:14:22Z"
},
"raw_key": "sk_test_Ab3d...redacted"
}{
"detail": "Invalid or expired token"
}{
"detail": {
"code": "kyc_scope_not_allowed",
"message": "This workspace is not enabled for the partner KYC API."
}
}{
"detail": [
{
"type": "value_error",
"loc": [
"body",
"scopes"
],
"msg": "Value error, unknown scope(s): foo",
"input": [
"foo"
]
}
]
}{
"code": "rate_limit_exceeded",
"message": "Too many requests. Please slow down."
}Create an API key
Who can call it: tenant_admin, tenant_api_manager or platform_admin.
The secret (raw_key) is returned once. A kyc:* scope needs a workspace enabled for the Partner KYC API, otherwise 403 kyc_scope_not_allowed. The key is used with the Partner API, not with these routes.
Auth: dashboard session (Authorization: Bearer <access token>). Not available with a partner API key.
Create an API key
curl --request POST \
--url https://app.sahlfinancial.com/api/v1/api-keys \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"name": "Back office (test)",
"scopes": [
"kyc:extract",
"kyc:verify"
]
}
'const options = {
method: 'POST',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({name: 'Back office (test)', scopes: ['kyc:extract', 'kyc:verify']})
};
fetch('https://app.sahlfinancial.com/api/v1/api-keys', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));import requests
url = "https://app.sahlfinancial.com/api/v1/api-keys"
payload = {
"name": "Back office (test)",
"scopes": ["kyc:extract", "kyc:verify"]
}
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text){
"key": {
"id": "9a2e6c4b-8d1f-4b57-9c3a-5e7f1d0b2a68",
"tenant_id": "0b6f5a3e-7c1d-4e0a-9d2f-3a1c5e8b7f10",
"name": "Back office (test)",
"prefix": "sk_test_Ab3d",
"scopes": "kyc:extract,kyc:verify",
"bound_identity": null,
"status": "active",
"last_used_at": null,
"expires_at": null,
"created_at": "2026-10-07T09:14:22Z"
},
"raw_key": "sk_test_Ab3d...redacted"
}{
"detail": "Invalid or expired token"
}{
"detail": {
"code": "kyc_scope_not_allowed",
"message": "This workspace is not enabled for the partner KYC API."
}
}{
"detail": [
{
"type": "value_error",
"loc": [
"body",
"scopes"
],
"msg": "Value error, unknown scope(s): foo",
"input": [
"foo"
]
}
]
}{
"code": "rate_limit_exceeded",
"message": "Too many requests. Please slow down."
}Authorizations
The access token (JWT) of a signed-in console user, from POST /v1/auth/login. It lasts 30 minutes. It is not an API key: a partner API key is refused here. There is no cookie.
Body
application/json