Authentication
API keys, Bearer tokens, and the difference between test-mode and live-mode keys.
All requests require an API key passed as a Bearer token in the Authorization header.
Key types
| Prefix | Purpose | Counts against quota |
|---|---|---|
vtv_live_ | Production traffic, real registry calls | Yes |
vtv_test_ | Testing, CI, local dev (deterministic magic numbers) | No, unlimited |
Both are issued the same way from your dashboard.
Making an authenticated request
curl "https://api.vatverify.dev/v1/validate?vat_number=DE811569869" \
-H "Authorization: Bearer vtv_live_xxx..."Error responses
401 unauthorized: key missing, invalid format, or revoked402 plan_required: key valid but the endpoint requires a higher plan (e.g.,/v1/deciderequires Business)
See Error codes for the full list.
Key rotation
Rotate keys from the dashboard. Revoked keys stop working within 60 seconds (our auth cache TTL).