Auth FAQ

Short answers to the questions integrators ask most about authenticating requests. Each answer links to the page with the full detail.

Why do I get 401 UnauthorizedError on every request?

The 401 never says why, so check in order. Send all three headers (X-API-Key, X-API-Timestamp, X-API-Signature), with the timestamp in milliseconds, and sign exactly timestamp + METHOD + requestURI + body, query string included. Then check the key's IP allow-list, the environment (a sandbox key doesn't exist in production) and the key type.

See Fixing a 401.

Does my server clock matter for the signature?

Yes. X-API-Timestamp must be within 1 minute of Avenia's clock. A server clock that drifts, or a timestamp in seconds instead of milliseconds, fails every request.

See Fixing a 401.

Why does the signature fail when the request has a body?

The signed body must be byte-for-byte the body you send. Serialize the JSON once, then sign and send that same string. If you build the JSON twice or let your HTTP client serialize the object again, the spacing or key order changes and the signature breaks.

See Sign a request.

Why does /v2/auth/api-keys reject my API key?

Routes under /v2/auth/ that need authentication (accesses, API keys, MFA) accept only a JWT. Log in to get one and send it as Authorization: Bearer <accessToken>. Every other authenticated route accepts your API key.

See Authentication.

How do I get an API key?

Turn on TOTP MFA for your access, generate a key pair, and register the public key with POST /v2/auth/api-keys/, authenticated with a JWT. The response is your API key ID. Sandbox and production are separate, so register a key in each environment you use.

See Set up an API key.