Authorization with a dashboard token

Before you start

• A current Python release and the requests package.
• Put the API address that came with your access into the environment variable API_BASE_URL. The samples never hard-code an address.
• Keep tokens and passwords out of the script and out of a repository. The samples read them from environment variables.

Create the token

Create the token in the dashboard, in the Access section, or with create token. A token has no name and no permissions to set. Store it as a secret.

The call

The token travels in the token field of the JSON body. The example reads the status of one session with session status.

import os

import requests

API = os.environ["API_BASE_URL"]
TOKEN = os.environ["API_TOKEN"]            # a permanent API token from the dashboard


def post(path: str, body: dict) -> dict:
    body = {"token": TOKEN, **body}
    reply = requests.post(f"{API}{path}", json=body, timeout=30)
    return reply.json()


answer = post("/kyc/session/status", {"sessionId": "00000000-0000-0000-0000-000000000000"})
print(answer.get("status"))

Check the answer, not the HTTP code

A failure normally arrives with a success HTTP code and a body whose status is error. Read the status field of the body. See response format and errors.

Multipart requests

For a request sent as multipart/form-data, pass the permanent API token as a form field named token.

with open("document.jpg", "rb") as image:
    reply = requests.post(
        f"{API}/kyc/process",
        data={"token": TOKEN, "schemaId": "<your scenario id>"},
        files=[("images", image)],
        timeout=60,
    )
print(reply.json().get("status"))

What to do when a token stops working

• A token that expired answers with 401. Create a new one, or update the expiry.
• A deleted token no longer works. Requests that use it stop going through.
• An address outside your IP allowlist is refused before the operation runs.