Credit & Passport

Partner authentication

Authenticate Credit and Financial Passport calls with an API key, exact-body HMAC and contracted purpose.

Headers

Header	When	Value
`X-API-Key`	Every partner endpoint	The full one-time `prefix.secret` key
`X-Signature`	POST, PUT, PATCH and DELETE	`sha256=<hex HMAC-SHA-256>` over the exact raw body
`X-Data-Use-Purpose`	Endpoints that release personal or financial data	A purpose approved for the partner

Exact-body rule

Compute the HMAC from the same UTF-8 bytes sent on the wire. Do not parse and reserialize JSON between signing and sending. Extract the secret as everything after the first dot in the API key.

Algorithm

signature = "sha256=" + hex(
  HMAC_SHA256(api_key_secret, exact_raw_request_body)
)

Compliance gates

Authentication proves which partner made the call. Data release additionally checks partner approval, beta status, key environment, DPA acceptance, jurisdiction and purpose. Treat a 403 as a policy decision; do not retry it as a transient error.

Rate limits

The service uses a token bucket per API key. The current default is 60 requests per minute with a burst of 120; configured premium limits may differ. On HTTP 429, honor Retry-After.