Authentication

Every request needs an API key. Keys look like idc_live_… or idc_test_… and are shown once, at creation. We store only a hash, so a lost key cannot be recovered — revoke it and make another.

HTTP — Authorization header

curl https://<host>/v1/resolve/did:eid:4pZ… \
  -H "Authorization: Bearer idc_live_…"

WebSocket — query parameter

const ws = new WebSocket("wss://<host>/v1/ws?key=idc_live_…")

Why the two differ

The browser WebSocket API takes a URL and an optional subprotocol list. There is no header argument — you cannot send an Authorization header on a handshake, so the key has to travel in the URL. Infura and Alchemy hit the same wall and made the same choice.

Prefer the header wherever you have one. Logging libraries strip Authorization; URLs get written to access logs and browser history.

Revocation

Revoking takes effect on the next request — there is no cache to wait out. An open WebSocket stays connected, but a reconnect is refused.