Authentication
Every API request requires two headers: an API key for authentication and a tenant ID for authorization.
Required headers
| Header | Description | Example |
|---|---|---|
Authorization | Bearer token with your API key | Bearer kora_abc123... |
X-Tenant-ID | UUID identifying your tenant account | 550e8400-e29b-41d4-a716-446655440000 |
curl https://idv.korastratum.com/api/v1/idv/verifications \
-H "Authorization: Bearer kora_abc123..." \
-H "X-Tenant-ID: 550e8400-e29b-41d4-a716-446655440000"
API key formats
All Kora IDV API keys are prefixed with kora_ followed by a random token — for example, kora_af6fe71cdf85…. A key is issued for a single environment (production or sandbox) and is scoped to your tenant. The environment is determined by which base URL you call the key against (see Environments below), not by the prefix.
Never expose production API keys in client-side code. API keys should only be used server-side. In production, the mobile SDKs receive verification IDs (session tokens) from your server; use a kora_ key directly only for SDK testing.
Environments
| Environment | Base URL | Use with |
|---|---|---|
| Production | https://idv.korastratum.com/api/v1/idv | kora_ keys |
| Sandbox | https://koraidv-identity-sandbox-626704085312.us-central1.run.app/api/v1 | kora_ keys |
Sandbox and production are separate hosts — send each key to its matching base URL. An kora_ key only works against the sandbox base URL; an kora_ key only works against production. Sending a sandbox key to the production host returns 401 INVALID_TOKEN.
The mobile SDKs handle this automatically: they detect the environment from your key prefix and select the correct base URL for you. For direct API/cURL usage, set the base URL to match your key's environment.
Rate limit headers
Every response includes rate limit information:
| Header | Description |
|---|---|
X-RateLimit-Limit | Maximum requests allowed per minute |
X-RateLimit-Remaining | Requests remaining in the current window |
X-RateLimit-Reset | Unix timestamp when the rate limit resets |
When you exceed your rate limit, you'll receive a 429 Too Many Requests response. See Rate Limits for per-tier limits.
Tenant ID
Your tenant ID is a UUID assigned when your account is created. Find it in your dashboard settings. The tenant ID scopes all resources (verifications, images, webhooks) to your account.