Authentication

API Keys

Getting Your Key

1. Go to Settings → API
2. Click Create API Key
3. Give it a name (e.g., “Zapier Integration”)
4. Copy the key immediately

Key Types

Test keys work identically but operate in test mode. No real data is affected.

Using Your Key

Include the key in the Authorization header:

curl https://api.govantage.co/v1/clients \
  -H "Authorization: Bearer vnt_sk_live_xxxxx"

Examples

curl https://api.govantage.co/v1/clients \
  -H "Authorization: Bearer vnt_sk_live_xxxxx" \
  -H "Content-Type: application/json"

Key Permissions

API keys inherit the permissions of the user who created them:

Key Management

Viewing Keys

See all keys in Settings → API:

• Key name
• Created date
• Last used
• Created by

Revoking Keys

To revoke a key:

1. Go to Settings → API
2. Find the key
3. Click Revoke
4. Confirm

Revoked keys stop working immediately.

Rotating Keys

To rotate without downtime:

1. Create new key
2. Update your integration
3. Verify new key works
4. Revoke old key

Security Best Practices

Do

• Store keys in environment variables
• Use test keys for development
• Rotate keys periodically
• Use minimal permissions needed

Don’t

• Commit keys to version control
• Share keys via email or chat
• Use live keys in development
• Give one key to multiple services

Environment Variables

Store keys safely:

# .env file
VANTAGE_API_KEY=vnt_sk_live_xxxxx

// Usage
const apiKey = process.env.VANTAGE_API_KEY;

Authentication Errors

Missing Key

{
  "error": {
    "code": "unauthorized",
    "message": "No API key provided"
  }
}

Invalid Key

{
  "error": {
    "code": "unauthorized",
    "message": "Invalid API key"
  }
}

Insufficient Permissions

{
  "error": {
    "code": "forbidden",
    "message": "API key does not have access to this resource"
  }
}

OAuth

For apps that need to act on behalf of users, OAuth 2.0 support is on the roadmap:

• Authorization code flow
• Granular scopes
• Token refresh

Contact us at legal@govantage.co if you need OAuth access for your integration.

Next Steps

• API Introduction - Endpoint overview
• Rate Limits - Usage limits
• Error Handling - Handle errors