SpoofSense uses two kinds of credentials that map to two trust levels: long-lived secret keys for your server and short-lived session tokens for your client. Understanding which credential to use — and where to keep it — is the first step in a secure integration.
Secret keys (sk_live_…)
Created in the console under Dashboard → API keys. Send a secret key on every server-side call using either the Authorization: Bearer header or the x-api-key header — both are equivalent:
- The plaintext key is shown once at creation; only a SHA-256 hash and the last four characters are stored. Lost keys can’t be recovered — revoke and create a new one.
- A revoked or disabled key returns
401 UNAUTHORIZED.
- When your credit balance reaches zero, keys stop working until you top up (Credits & billing).
Secret keys authorize spending your credits and retrieving stored biometric captures. Keep them in server-side environment variables only — never in client code, mobile builds, or version control.
Session client tokens (sst_…)
Short-lived, single-use tokens for the verification session capture flow. Your backend mints one by creating a session with its secret key, then hands only the token to the browser or app:
A session token can do exactly two things: read its own session’s metadata (GET /v1/verification_sessions/session_info) and submit a capture (POST /v1/verification_sessions/submit). It can never read a decision, a score, or stored media — so a token leaked from a client is not a path to anything sensitive.
Credential comparison
