Authentication
API keys, bearer tokens, and test vs live.
Every /v1 request authenticates with a Bearer token:
Authorization: Bearer bsk_live_xxxKey format
bsk_<env>_<random> where <env> is live or test.
| Prefix | Billed | Use |
|---|---|---|
bsk_live_ | Yes (counts against your NGN subscription tier cap) | Production |
bsk_test_ | Free up to 25 parses/owner/month, then a canned sample | Integration + onboarding |
Past the 25-parse monthly cap a test key does not error. It returns a 200 with a canned synthetic sample (an additive _sample marker in the JSON and an X-Bankstract-Sample: true header). The engine does not run on the sample response.
You have exactly one active test key. It is auto-provisioned when you sign up and rotated with POST /v1/keys/test (the old key is revoked and a new raw key is returned once). Live keys are unlimited per owner.
Keys are shown once at creation and stored only as an argon2 hash. We can't recover a lost key, so store it securely. Revoke and re-issue if it leaks.
Errors
401: missing, malformed, or revoked key. The body is the standard error envelope witherror_class: "AuthError".
AGPL note
The hosted service is AGPL-3.0, but API consumers do not inherit AGPL. You interact over an HTTP boundary, not a source-level dependency. Build closed-source products on top of the API freely. (A SaaS-hosted fork of the service itself must open-source its changes.)