Authentication & keys

The API authenticates with an API key sent in the X-API-Key header. Keys are managed in the portal under Settings → API keys. We store only a one-way fingerprint of each key, so the full key is shown once when it’s generated — copy it into your secret store then. If a key is lost, rotate it to get a new one instantly.

curl https://api.statementiq.com.au/v1/requests \
  -H "X-API-Key: siq_test_your_key"

Test and live keys

Every company has two keys, and the key you use decides the environment of the call — the same model as Stripe’s test and live keys:

• siq_test_… — test (sandbox). Runs against mock bank data. Always available, from the moment you sign up. Use it to build and test your integration end to end. The consent flow is pinned to Fiskil’s Banking Sandbox Data Holder, so nothing here can touch a real bank account — even after your company is approved for production.
• siq_live_… — live (production). Connects real customers’ banks through the CDR. It activates once your company is approved for production (see the go-live checklist in the portal). A live request creates a real CDR consent.

Getting approved for production

Before your live key works, we verify your business and its permitted use of CDR data — an obligation we carry as a CDR Representative. Complete the short due-diligence application on the go-live checklist in your portal. Approval is usually within one business day.

Keeping keys safe

• Treat keys like passwords. Never embed them in front-end code, mobile apps, or public repositories.
• Keys are shown once at generation and stored only as a fingerprint — we can never read a key back to you.
• Rotating a key in Settings immediately revokes the old one. Rotate straight away if a key may be exposed.
• Each key can be rotated independently — rotating your test key does not affect your live key.

Rate limits

Authenticated endpoints are rate-limited per company (240 requests per minute by default). Exceeding the limit returns 429 with a Retry-After header — back off for that many seconds and retry. Reports are pushed to you by webhook, so polling tight loops is never necessary.

Errors

A missing or invalid key returns 401:

{ "detail": "invalid or missing API key" }

Using a live key before your company is approved returns 403 when creating a request. Some actions — such as sending a consent link by email or SMS — are production-only and return 403 in sandbox.