Skip to main content
Public API v2 authenticates with a user API key. Create one in the Slash dashboard under Settings → API keys, keep it on your server, and send it on every request together with the legal entity to act on (find its id):
Never embed an API key in browser or mobile application code.

​
User API keys

A user API key acts as the user who created it, with that user’s current access. Every action it performs has a human requester for authorization, payment policies, and audit attribution. Because a user can belong to several legal entities, the key is not tied to one. Name the legal entity on every request with the x-legal-entity header. The selected entity must be one the user can access; requests that omit the header return 400 invalid_request, and requests naming an entity the user cannot access return 403 forbidden. A valid key does not imply access to every account, virtual account, recipient, or transaction. The key can only do what its user can do. GET /v2/legal-entities lists the legal entities your key’s user can act on, with each one’s id and name. It is the one request that takes no x-legal-entity header:
Send the id of the legal entity you want as x-legal-entity on every other request. Members of several legal entities get one entry each. Keys created under a legal entity’s API management page are not accepted by v2. A v2 request made with one returns 403 user_api_key_required. Those keys continue to work with the v1 API.

​
IP allowlisting

Some sensitive routes require IP allowlisting to be enabled for the legal entity. Requests to those routes must originate from an allowed IP address or they return 403 forbidden. The API Reference identifies routes with this requirement. GET /v2/legal-entities names no legal entity, so no allowlist applies to it.

​
Authentication failures

A missing, invalid, or inactive API key returns 401 unauthorized. An authenticated key that is not permitted to perform an action returns 403 forbidden.