# Incode API Keys API

**Canonical:** https://apis.io/apis/incode/incode-api-keys-api/  
**Provider:** Incode — https://apis.io/providers/incode/  
**Base URL:** https://demo-api.incodesmile.com  
**Documentation:** https://developer.incode.com/docs/onboarding-integration

Incode API Keys API is one of 37 APIs that [Incode](https://apis.io/providers/incode/) publishes on the [APIs.io](https://apis.io/) network, described by a machine-readable OpenAPI specification. Tagged areas include APIKeys. The published artifact set on APIs.io includes an OpenAPI specification, API documentation, and an API reference.

Following endpoints facilitate API key rotation, for security reasons - current key gets stolen, user access needs to be revoked, organization expires, etc. It is good practice to rotate them every once in a while, regardless (e.g. every three months). **Migration** There used to be only one API key per organization, created and registered on API Gateway at the time of organization creation. Each organization has a user defined `name`, on which 3 random digits are added to generate `clientId`, on which sha1 was applied to generate `apiKey`. Field `clientId` was also used as organization identifier, while `apiKey` also served as organization reference. With the rotatable approach, API key management is delegated to a separate collection, which would contain `clientId` and `value` for each record. This also enables having multiple API keys per organization. Fields `clientId`/`apiKey` on organization entity will keep their identifier/reference function, to maintain referential integrity between entities. In order to facilitate the new approach and ensure backwards compatibility, a migration process is established. Through it, API key related fields are copied from Organization to RotatableApiKey collection, so that in the end each organization would have a corresponding rotatable key created. Key validity is checked on API Gateway directly (if applicable, otherwise set to `true`). All subsequent API key management would affect new collection only.

## Operations (3)

| Method | Path | Summary |
|---|---|---|
| GET | `/omni/api-key` | Fetch |
| PUT | `/omni/api-key` | Update |
| POST | `/omni/api-key` | Create |

## Machine-readable artifacts (16)

- **OpenAPI** — https://raw.githubusercontent.com/api-evangelist/incode/refs/heads/main/openapi/incode-api-keys-api-openapi.yml
- **Documentation** — https://developer.incode.com/docs/onboarding-integration
- **APIReference** — https://developer.incode.com/docs/api-onboarding-start-session
- **PostmanCollection** — https://raw.githubusercontent.com/api-evangelist/incode/refs/heads/main/collections/incode.postman_collection.json
- **OpenCollection** — https://raw.githubusercontent.com/api-evangelist/incode/refs/heads/main/collections/incode.opencollection.json
- **Documentation** — https://developer.incode.com/docs/api-onboarding-id-validation
- **APIReference** — https://developer.incode.com/reference/processid
- **Documentation** — https://developer.incode.com/docs/api-onboarding-face-validation
- **APIReference** — https://developer.incode.com/reference/processface
- **Documentation** — https://developer.incode.com/docs/government-verification
- **APIReference** — https://developer.incode.com/reference/processgovernmentvalidation
- **Documentation** — https://developer.incode.com/docs/global-watchlist
- **Documentation** — https://developer.incode.com/docs/how-to-fetch-onboarding-results-and-data
- **APIReference** — https://developer.incode.com/docs/fetch-scores
- **Documentation** — https://developer.incode.com/docs/onboarding-status-webhook
- **APIReference** — https://developer.incode.com/docs/webhooks

## Other Incode APIs (12)

- [Incode Government Validation API](https://apis.io/apis/incode/incode-government-validation-api/)
- [Incode Onboarding API](https://apis.io/apis/incode/incode-onboarding-api/)
- [Incode API validations API](https://apis.io/apis/incode/incode-api-validations-api/)
- [Incode Authentications API](https://apis.io/apis/incode/incode-authentications-api/)
- [Incode Curp validation API](https://apis.io/apis/incode/incode-curp-validation-api/)
- [Incode Custom fields API](https://apis.io/apis/incode/incode-custom-fields-api/)
- [Incode Custom watchlist API](https://apis.io/apis/incode/incode-custom-watchlist-api/)
- [Incode Document capture API](https://apis.io/apis/incode/incode-document-capture-api/)
- [Incode Ekyb API](https://apis.io/apis/incode/incode-ekyb-api/)
- [Incode Ekyc API](https://apis.io/apis/incode/incode-ekyc-api/)
- [Incode Electronic signature advanced API](https://apis.io/apis/incode/incode-electronic-signature-advanced-api/)
- [Incode Electronic signature API](https://apis.io/apis/incode/incode-electronic-signature-api/)

## Tags

APIKeys

---

Profiled by [API Evangelist](https://apievangelist.com) and published on [APIs.io](https://apis.io/apis/incode/incode-api-keys-api/). The API's provider profile, Kin Score and agent-readiness rating are at https://apis.io/providers/incode/.