Skip to main content
Public API v2 authenticates with a user API key. Create one in the Slash dashboard under Settings → API keys, keep it on your server, and send it on every request together with the legal entity to act on:
Never embed an API key in browser or mobile application code.

​
User API keys

A user API key acts as the user who created it, with that user’s current access. Every action it performs has a human requester for authorization, payment policies, and audit attribution. Because a user can belong to several legal entities, the key is not tied to one. Name the legal entity on every request with the x-legal-entity header. The selected entity must be one the user can access; requests that omit the header return 400 invalid_request, and requests naming an entity the user cannot access return 403 forbidden. A valid key does not imply access to every account, virtual account, contact, or transaction. The key can only do what its user can do. Keys created under a legal entity’s API management page are not accepted by v2. A v2 request made with one returns 403 user_api_key_required. Those keys continue to work with the v1 API.

​
IP allowlisting

Some sensitive routes require IP allowlisting to be enabled for the legal entity. Requests to those routes must originate from an allowed IP address or they return 403 forbidden. The API Reference identifies routes with this requirement.

​
Authentication failures

A missing, invalid, or inactive API key returns 401 unauthorized. An authenticated key that cannot perform an action returns either 403 forbidden or an information-hiding 404 not_found, depending on the resource boundary. Do not use these responses to infer whether an inaccessible resource exists.