Authentication & credentials

AvraAPI provider and UPG server APIs authenticate a request using a project Client ID, Client Secret, and environment selector.

Required headers

X-API-KEY: your_project_client_id
X-API-SECRET: your_project_client_secret
X-ENV: development
Accept: application/json

Header	Purpose
`X-API-KEY`	Identifies the project credential.
`X-API-SECRET`	Proves possession of the secret. Send it only from your server.
`X-ENV`	Selects the credential’s project environment. Use `dev` or `development` for Development; use `prod` or `production` only from your production integration.

When X-ENV is omitted, the API treats the request as Development. The credential is still checked against that environment boundary.

Store secrets safely

Recommended
Never do this

Use an environment variable or a managed secret store in your backend. Limit access to the process that makes AvraAPI requests.

# Server-side environment configuration only
AVRAAPI_CLIENT_ID=your_development_client_id
AVRAAPI_CLIENT_SECRET=your_development_client_secret
AVRAAPI_ENV=development

Generate and rotate credentials

The dashboard shows a full Client Secret only when it is generated or rotated. If it is lost or exposed, rotate it immediately and update every affected server deployment.

Rotating a credential invalidates the previous secret. Plan a controlled deployment so your running application receives the replacement before the old credential is removed from use.

Authentication failures

Missing, inactive, mismatched, or invalid credentials produce an unauthorized error. Paused projects return project_paused and should be handled as an operational state rather than retried continuously.

{
  "success": false,
  "request_id": "2da44813-ec46-4dde-b403-6a371543e2b9",
  "error": {
    "code": "unauthorized",
    "message": "Invalid API key or environment."
  },
  "meta": {
    "provider_override": null
  }
}

See API key safety for incident-response guidance.

Getting Started

Workspaces

Security & Integration

Documentation

Authentication & credentials

Required headers

Store secrets safely

Generate and rotate credentials

Authentication failures

​Required headers

​Store secrets safely

​Generate and rotate credentials

​Authentication failures

Required headers

Store secrets safely

Generate and rotate credentials

Authentication failures