Authentication
The iNwealth API uses API keys for authentication. Each organization receives a unique key at onboarding.
- Prefix:
sk_live_
- 32 hex characters (128 bits of entropy)
- Shown once at generation — store it securely
- Hashed with SHA-256 server-side (never stored in plaintext)
Usage
Include your API key in the Authorization header of every request:
Security best practices
Never expose your API key in client-side code (browser, mobile app). Always call the iNwealth API from your backend.
- Store your key in environment variables or a secrets manager
- Rotate keys periodically by requesting a new one
- If a key is compromised, contact us immediately — we can revoke it instantly
Error responses
