> Guveno API reference v1.10.0, last updated October 17, 2026. The whole reference is at https://www.guveno.com/llms-full.txt.

## Authentication

Every request authenticates with an API key: a long-lived bearer token you generate in the dashboard and feed to your server, the SDK, or the CLI.

### The API key

The API is API-key-only. Generate a key in [the dashboard](https://dashboard.guveno.com/login) under **Developer → API Keys**, scope it to the wallets and actions it needs, and use it as the bearer token on every request. There is no login, signup, or session flow to script. Account setup (creating the company, members, multi-factor auth, your encryption key) happens once in the dashboard, and everything your integration does afterward uses the key.

Keys are prefixed with `gv_live_`. The secret is shown **once** at creation. Store it somewhere safe; it can't be recovered. See **API keys** for format, expiry, and revocation.

### The Authorization header

Send the key in the `Authorization` header on every request:

```
Authorization: Bearer gv_live_your_key_here
```

```
curl https://api.guveno.com/v1/wallets \
  -H "Authorization: Bearer gv_live_your_key_here"
```

### Base URL

All requests go to the production API below. The SDK and CLI use it by default, so you never need to set it. Self-hosted servers can point at their own host; see **Advanced configuration**.

```
https://api.guveno.com/v1
```

### What an API key can do

- **It can** do exactly the actions you granted, on exactly the wallets you granted (see **Permissions & scoping**): read wallets, balances and transactions, generate addresses, propose withdrawals for someone to approve, prepare/broadcast withdrawals, plus two global actions (create wallets, manage webhooks). Everything else returns `403`/`404`. `GET /me` always works.
- **With a signing action** (`withdrawals:create` or `wallets:generate_address`) it can also read that wallet's encrypted secret (`GET /wallets/:id/secret`, audited) so the SDK/CLI can unseal it locally to derive an address or sign.
- **It cannot** manage the account: creating, updating, or revoking API keys, inviting members, changing your password, and setting up your encryption key are dashboard-only and reject API keys with `403`.

### Keeping keys safe

Treat keys like passwords. Never embed them in a browser app, mobile app, or public repository; they belong only on your servers. Scope each key to the fewest wallets and actions that do the job, optionally lock it to your server's source IPs, and revoke any key you suspect is exposed.

Source: https://www.guveno.com/docs/authentication/