Server-to-server requests to the tenant external API are authenticated with an API key pair. Dashboard and admin-console routes use user sessions instead. A route accepts API keys only when it is documented for API-key access and is backed by an explicit scope. Every request to a tenant-scoped endpoint must include your API key pair:
HeaderValue
x-api-keyYour publishable key, e.g. pk_live_...
x-api-secretYour secret key, e.g. sk_live_...
Content-Typeapplication/json
The tenant is resolved automatically from the key pair - you never pass tenantId in the URL or body. See Authentication concepts for the full model - key types, rotation, and SSO.

​
API key scopes

Every live and sandbox API key is assigned the complete documented scope set. See External API surface for the current scope list and the 14 V2 API groups. Routes without an API-key scope return 403 key_forbidden for API-key callers, even if the same route is available in the dashboard with a user session. When new documented scopes are introduced, active keys are synchronized additively so the same credentials continue to work. Key rotation remains available for credential rotation. Zquence does not expose public API-key scope update/delete endpoints today. Sanctions integrations commonly use sanctions.screen, sanctions.read, sanctions.review, and sanctions.export. Webhook inspection and management use webhooks.read and webhooks.write respectively. Each key remains bound to one environment.

​
Example

curl https://v2.app-dev.zquence.com/v1/tenants/me \
  -H "x-api-key: pk_live_51H..." \
  -H "x-api-secret: sk_live_51H..."
A successful request returns 200 with the tenant profile: 
{
  "tenantId": "tnt_01HX3Z8MQW...",
  "name": "Acme Escrow",
  "status": "active",
  "createdAt": "2026-04-22T09:12:44.000Z"
}

​
Errors

StatusCodeCause
401key_missingBoth headers must be present.
401key_invalidKey pair doesn’t match an active key.
401key_revokedKey was revoked. Use a new one.
403key_forbiddenKey lacks the required scope, or the route is not enabled for API-key access.