Authentication and environments

Connect API v3 authenticates server-to-server requests with X-API-Key. The key resolves the ISV workspace and the permissions available to the request.

Key acquisition dependency: Complyance provisions Connect API keys, but the approved request or generation URL, process owner, and self-service instructions have not been confirmed in the source specification. Do not substitute a guessed portal link. Product must add the confirmed key-management path before this page is shared as a complete self-service guide.

Send the API key

X-API-Key: YOUR_API_KEY

Do not send workspaceId. Complyance resolves the workspace from the key and scopes requests to it.

Store the key safely

Store it in a server-side secret manager.
Read it only in the backend process that calls Connect API v3.
Do not put it in browser code, mobile or desktop client applications, source control, examples, or logs.
Rotate or revoke it through the confirmed key-management process if it may have been exposed.

Choose the environment

The onboarding and count endpoints select environments differently.

Operation	Selector	Supported values	Default
UAE company onboarding	`platformEnvironment` JSON field	`sandbox`, `simulation`, `production`	`sandbox`
Document counts	`X-Environment` header	`sandbox`, `production`	`production`

There is no separate sandbox hostname. Both endpoints use https://prod.gets.complyance.io.

Always set the environment explicitly. Start in sandbox, complete the UAE prerequisite in that same environment, and use X-Environment: sandbox for the connected count request. Document counts do not support simulation; behavior for simulation-onboarded companies remains undocumented until Engineering confirms it.

Onboarding environment example

{
  "platformEnvironment": "sandbox"
}

Document-count environment example

X-Environment: sandbox

Authentication and authorization failures

Do not retry authentication failures blindly. Verify the key, selected environment, workspace access, and Connect permission, then use the confirmed key-management or support path with meta.requestId.

Endpoint	Status	Documented behavior
UAE onboarding	`401`	The API key is missing or invalid. `meta.workspaceId` is omitted when the workspace cannot be safely resolved.
UAE onboarding	`403`	The caller lacks access to the resolved workspace, environment, or operation.
Document counts	`401 CONNECT_AUTH_CONTEXT_MISSING`	The key is missing, invalid, or did not provide a workspace context.
Document counts	`403 CONNECT_ISV_ACCESS_DENIED`	The authenticated workspace cannot use Connect APIs.

The approved onboarding contract does not yet name the public 400, 401, 403, and 429 codes for every condition. Engineering must verify those names and both unauthenticated and authenticated envelopes against the deployed gateway before they are presented as deployed behavior. See Errors and troubleshooting.

Next step: Complete the UAE onboarding prerequisites.