> ## Documentation Index
> Fetch the complete documentation index at: https://docs.verifyyou.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Base URL, keys, partitions, and the errors every endpoint can return.

Base URL `https://trust.verifyyou.com`. `Authorization: Bearer <secret key>` on every request. Raw spec: [`openapi.json`](https://trust.verifyyou.com/openapi.json). Try it: [Swagger UI](https://trust.verifyyou.com/docs).

| Endpoint | Purpose |
| - | - |
| [`POST /v3/initialize`](/v3/dev/spec/server-api/initialize) | Mint a session |
| [`GET /v3/confirmations/{token}`](/v3/dev/spec/server-api/confirmations) | Exchange a token for the verdict |
| [`POST /v3/confirmations/{token}/lock`](/v3/dev/spec/server-api/lock) | Consume a pass |
| [`POST /v3/confirmations`](/v3/dev/spec/server-api/lookup) | Verdict by email or phone, no token |
| [`POST /v3/test/confirmation-token`](/v3/dev/spec/server-api/test-confirmation-token) | Mint a token for your test suite |

## Keys

Secret keys, `sk_test_…` and `sk_live_…`. Server only. Test keys see test runs; live keys see live runs. A token or session from one partition reads as nonexistent under the other.

Publishable keys (`pk_*`) are deprecated. Start every session server side and open it in the browser with `vycheck({ session })`.

## Errors on every endpoint

Errors are `{ "detail": "<code>" }`, except `422` (schema validation, an array).

| Status | `detail` | When |
| - | - | - |
| `401` | `authentication_required` | No `Authorization` header. |
| `401` | `invalid_key_type` | Not a secret key. |
| `401` | `invalid_or_revoked_key` | Key not found or revoked. |

Deprecated and still served (see the [OpenAPI spec](https://trust.verifyyou.com/openapi.json)): `POST /v3/keys/test`.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.