Authentication

Every request must include an Authorization: Bearer header. Scorift issues two key types with different privilege boundaries.

Key types

• sk_live_… — Server-side production key. Full read/write access. Never expose in a browser.
• sk_test_… — Sandbox key with the same shape as production but no billing or downstream side effects.

Sending an authenticated request

curl https://api.scorift.com/v1/transactions/trc_01HBX7YQ \
  -H "Authorization: Bearer sk_live_XXXXXXXXXXXXXXXX"

Going live: how to install your production key

Your production key is the only credential that can write real decisions to your live environment. Treat it like a database password.

1. Create a live key in the Scorift dashboard under API Keys. Choose the Live environment, give it a descriptive name (e.g., Production · Web Checkout), and copy the secret. You will only see it once.
2. Store it in a secrets manager. Do not paste it into source code, commit it to Git, or share it in Slack. Supported options:
   • Environment variables on your server (e.g., SCORIFT_API_KEY).
   • AWS Secrets Manager, Azure Key Vault, or Google Secret Manager.
   • HashiCorp Vault, 1Password Secrets Automation, or Doppler.
3. Read it server-side only. Your backend reads the secret at runtime and forwards it to Scorift. Never expose sk_live_… to browsers, mobile apps, or public repositories.
4. Point to the production base URL: https://api.scorift.com/v1. Sandbox keys use https://sandbox.scorift.com/v1.

Recommended environment variable pattern

# .env (server only, never committed)
SCORIFT_API_KEY=sk_live_...
SCORIFT_API_URL=https://api.scorift.com/v1

# application code
const decision = await scorift.score({
  apiKey: process.env.SCORIFT_API_KEY,
  event: "payment.attempt",
  amount: 249.00,
});

Promoting from sandbox to production

No code changes are required. When your integration is ready, swap the test key and URL for the live ones:

# Sandbox
SCORIFT_API_KEY=sk_test_...
SCORIFT_API_URL=https://sandbox.scorift.com/v1

# Production
SCORIFT_API_KEY=sk_live_...
SCORIFT_API_URL=https://api.scorift.com/v1

Keep separate keys per deployment environment (staging, production) so a rotation or compromise in one does not affect the other.

Common mistakes to avoid

• Hardcoding a key in source code or a frontend bundle.
• Committing .env files containing sk_live_… to version control.
• Using a live key in unit tests, CI fixtures, or local development.
• Sharing the same key across multiple services instead of one key per service.

Scopes

Keys can be scoped in the dashboard to a subset of capabilities:

• score:write — Submit events to /v1/score.
• rules:read · rules:write — Manage the rules engine.
• cases:read · cases:write — Read and update case dispositions.
• webhooks:manage — Register and rotate webhook endpoints.

Rotating keys

Rotate keys from Settings → API Keys. Rotation issues a new secret, keeps the previous key valid for a 24-hour grace window, and emits an audit-log entry. Update your secrets manager immediately, then revoke the old key once all services have rolled over.

Mutual TLS (Enterprise)

Enterprise tenants can enable mTLS on their dedicated endpoint. Go to Dashboard → Security → Mutual TLS (mTLS), upload the client CA that signs your certificates, then pin the Scorift-issued server certificate shown there for defense-in-depth. API keys are still required — mTLS adds a transport-layer check on top.

Rate limits

Default limits are 500 req/s per key with burst up to 1,000 req/s. Every response includes X-RateLimit-Remaining and X-RateLimit-Reset headers.