Authentication and environments

Connect API v3 authenticates server-to-server requests with X-API-Key. The key resolves the ISV workspace and the permissions available to the request.

Generate a key

In the ISV portal, open API Keys, choose the environment, select read and write access for onboarding and invoicing, and create the key. Copy the secret when it is displayed; it is shown only once.

Create separate keys for sandbox and production. Revoke and replace a key immediately if it may have been exposed.

Send the API key

X-API-Key: YOUR_API_KEY

Do not send workspaceId. Complyance resolves the workspace from the key and scopes requests to it.

Unify V2 and document-status requests use the same workspace key as a Bearer token:

Authorization: Bearer YOUR_API_KEY

Do not send both authentication headers in one request.

Store the key safely

Store it in a server-side secret manager.
Read it only in the backend process that calls Connect API v3.
Do not put it in browser code, mobile or desktop client applications, source control, examples, or logs.
Rotate or revoke it through the confirmed key-management process if it may have been exposed.

Choose the environment

The onboarding and count endpoints select environments differently.

Operation	Selector	Supported values	Default
UAE company onboarding	`platformEnvironment` JSON field	`sandbox`, `simulation`, `production`	Required
Unify V2	`environment` JSON field	`sandbox`, `production`	Required
Document counts	`X-Environment` header	`sandbox`, `production`	`production`

There is no separate sandbox hostname. Both endpoints use https://prod.gets.complyance.io.

Always set the environment explicitly. Start in sandbox, complete the UAE prerequisite in that same environment, and use X-Environment: sandbox for the connected count request. The Unify request environment must match the API-key environment. Document counts do not support simulation.

Onboarding environment example

{
  "platformEnvironment": "sandbox"
}

Document-count environment example

X-Environment: sandbox

Authentication and authorization failures

Do not retry authentication failures blindly. Verify the key, selected environment, workspace access, and Connect permission, then use the confirmed key-management or support path with meta.requestId.

Endpoint	Status	Documented behavior
UAE onboarding	`401`	The API key is missing or invalid. `meta.workspaceId` is omitted when the workspace cannot be safely resolved.
UAE onboarding	`403`	The caller lacks access to the resolved workspace, environment, or operation.
Document counts	`401 CONNECT_AUTH_CONTEXT_MISSING`	The key is missing, invalid, or did not provide a workspace context.
Document counts	`403 CONNECT_ISV_ACCESS_DENIED`	The authenticated workspace cannot use Connect APIs.

The approved onboarding contract does not yet name the public 400, 401, 403, and 429 codes for every condition. Engineering must verify those names and both unauthenticated and authenticated envelopes against the deployed gateway before they are presented as deployed behavior. See Errors and troubleshooting.

Next step: Complete the UAE onboarding prerequisites.