Authentication - Cove Data Furnishing API

API Key Format

All requests require an x-api-key header with a valid API key.

sk_{env}_{32_character_random_token_here}
│  │      └─ 32-character random token
│  └──────── environment: live or test
└──────────── prefix: sk (secret key)

Using your API key

Include the key in every request:

curl https://vvdufluovypptsnkihyv.supabase.co/functions/v1/consumers \
  -H "x-api-key: sk_test_your_api_key_here"

Sandbox vs Production

Key prefix	Mode	Behavior
`sk_test_`	Sandbox	Data is created normally. Metro 2 files are generated but never uploaded to bureaus. Simulated bureau responses are returned.
`sk_live_`	Production	Full pipeline: data → Metro 2 → SFTP upload → bureau processing → webhook notifications.

Use sandbox keys during development and integration testing. Webhooks fire normally in both modes.

Authentication Errors

Scenario	Error Code	HTTP Status
Missing `x-api-key` header	`AUTHENTICATION_ERROR`	401
Invalid key format	`AUTHENTICATION_ERROR`	401
Key not found or hash mismatch	`AUTHENTICATION_ERROR`	401
Partner account suspended	`AUTHORIZATION_ERROR`	403
Key environment mismatch	`AUTHENTICATION_ERROR`	401

Example error response

{
  "error": {
    "code": "AUTHENTICATION_ERROR",
    "message": "Missing x-api-key header",
    "request_id": "4e9024e3-125d-4d08-a392-4fa34f6bda44"
  }
}