Authentication

Every request authenticates with an API key: a long-lived bearer token you generate in the dashboard and feed to your server, the SDK, or the CLI.

The API key

The API is API-key-only. Generate a key in the dashboard under Developer → API Keys, scope it to the wallets and actions it needs, and use it as the bearer token on every request. There is no login, signup, or session flow to script. Account setup (creating the company, members, multi-factor auth, your encryption key) happens once in the dashboard, and everything your integration does afterward uses the key.

Keys are prefixed with gv_live_. The secret is shown once at creation. Store it somewhere safe; it can't be recovered. See API keys for format, expiry, and revocation.

The Authorization header

Send the key in the Authorization header on every request:

Authorization: Bearer gv_live_your_key_here

curl https://api.guveno.com/v1/wallets \
  -H "Authorization: Bearer gv_live_your_key_here"

Base URL

All requests go to the production API below. The SDK and CLI use it by default, so you never need to set it. Self-hosted servers can point at their own host; see Advanced configuration.

https://api.guveno.com/v1

What an API key can do

• It can do exactly the actions you granted, on exactly the wallets you granted (see Permissions & scoping): read wallets, balances and transactions, generate addresses, propose withdrawals for someone to approve, prepare/broadcast withdrawals, plus two global actions (create wallets, manage webhooks). Everything else returns 403/404. GET /me always works.
• With a signing action (withdrawals:create or wallets:generate_address) it can also read that wallet's encrypted secret (GET /wallets/:id/secret, audited) so the SDK/CLI can unseal it locally to derive an address or sign.
• It cannot manage the account: creating, updating, or revoking API keys, inviting members, changing your password, and setting up your encryption key are dashboard-only and reject API keys with 403.

Keeping keys safe

Treat keys like passwords. Never embed them in a browser app, mobile app, or public repository; they belong only on your servers. Scope each key to the fewest wallets and actions that do the job, optionally lock it to your server's source IPs, and revoke any key you suspect is exposed.