Authentication Overview

Last updated: Phase 8.5

ValidonX supports two authentication methods depending on your use case:

Method	Use Case	Header	Audience
API Key	Integration API (license validation, activations, usage)	X-API-Key	External applications, SDKs
Bearer Token	Tenant Dashboard, Admin Dashboard, Billing Portal	Authorization: Bearer {token}	Authenticated users

API Key Authentication

For server-to-server integration (license validation, activation, entitlement checks, usage reporting):

POST /api/v1/integration/licenses/{key}/validate
X-API-Key: vx_abc123def456...
Content-Type: application/json

API keys are tenant-scoped. Each key resolves to exactly one tenant. Keys are hashed with HMAC-SHA256 before storage — the raw key is shown only once at creation time.

See API Keys for details.

Bearer Token Authentication

For dashboard and portal access:

GET /api/v1/tenant/products
Authorization: Bearer 1|abc123...
X-Tenant-ID: tenant-uuid
Content-Type: application/json

Tokens are issued via POST /api/auth/login and carry ability scopes (admin or tenant).

See Token Auth for details.

Required Headers

All requests should include:

Header	Required	Description
Content-Type	Yes	application/json
X-API-Key	Integration API only	Your API key
Authorization	Dashboard/portal only	Bearer {token}
X-Tenant-ID	Multi-tenant users only	Tenant UUID (auto-selected for single-tenant users)
X-Request-ID	Recommended	UUID for request tracing

Response Headers

All responses include:

Header	Description
X-ValidonX-API-Version	Always 1
X-Request-ID	Request trace ID (echoed from request or generated)
X-RateLimit-Limit	Rate limit ceiling (integration API)
X-RateLimit-Remaining	Remaining requests
X-RateLimit-Reset	Unix timestamp when limit resets