Authentication & Headers — SyncNexa Docs

All requests to the SyncNexa API must be made over HTTPS. Authentication is handled via Bearer API keys passed in the standard Authorization request header.

Base URLs & Environments

Service	Production Base URL	Purpose
Business API Gateway	`https://api.business.syncnexa.co`	Applications, API keys, OAuth clients, webhooks, analytics
Verification Service	`https://api.business.syncnexa.co/verification/v1`	Creating and querying verification sessions
Consent Service	`https://api.business.syncnexa.co/consent/v1`	Student consent tracking and permission records
Static Assets CDN	`https://assets.syncnexa.co`	Official logos, email hero images, brand badges

Bearer Token Authentication

Provide your secret key (sk_test_... or sk_live_...) in the Authorization header:

authorization-header.txtbash

1 Authorization: Bearer sk_live_YOUR_SECRET_KEY

Standard HTTP Headers

Parameter	Type	Required	Description
`Authorization`	string	Required	Bearer token with your secret API key (sk_test_... or sk_live_...). Example: `Bearer sk_live_123...`
`Content-Type`	string	Required	MIME type of the request payload. Must be application/json for JSON payloads. Example: `application/json`
`X-SyncNexa-Version`	string	Optional	Optional API version pin. Defaults to the account's default API version. Default: `2026-08-01` Example: `2026-08-01`
`Idempotency-Key`	string	Optional	Unique UUID to prevent duplicate operations on network retries. Example: `9b1deb4d-3b7d-4bad-9bdd-2b0d7b3dcb6d`

Rate Limiting & Throttling

API requests are rate-limited per application to prevent abuse and protect platform stability. Rate limit status is communicated in every response header:

X-RateLimit-Limit: Maximum requests permitted within the current window.
X-RateLimit-Remaining: Number of requests remaining in the current window.
X-RateLimit-Reset: Unix timestamp when the rate limit quota resets.

If your application exceeds its rate limit, the API returns HTTP 429. Implement exponential backoff with jitter when retrying failed requests.

Authentication Errors

401-unauthorized.jsonjson

1 {
2   "error": {
3     "code": "UNAUTHORIZED",
4     "message": "Invalid or revoked API key provided in Authorization header.",
5     "docUrl": "https://docs.syncnexa.co/api/authentication"
6   }
7 }

Was this page helpful?

1	{
2	"error": {
3	"code": "UNAUTHORIZED",
4	"message": "Invalid or revoked API key provided in Authorization header.",
5	"docUrl": "https://docs.syncnexa.co/api/authentication"
6	}
7	}