Authentication

OpenFi uses standard bearer API keys for account-level authentication, plus a separate signing scheme for agentic session keys.

API keys

Every request must include your account API key in the Authorization header:

curl https://api.openfi.co/v1/payments \
  -H "Authorization: Bearer sk_live_..."

Prefix	Environment
`sk_testnet_...`	Testnet: simulated rails, no real money movement
`sk_live_...`	Mainnet

Keep live API keys server-side only. Never embed a live key in client-side or agent-facing code; use a scoped session key instead (see below).

Session keys (for autonomous agents)

An API key authenticates your backend. A session key authenticates an individual AI agent acting within the limits of a specific mandate. It’s how an agent transacts without ever holding your master API key or a wallet’s private key. Session keys are:

Time-bound: created with an explicit expires_in
Velocity-bound: capped by the max_amount / interval set on the parent mandate
Revocable: can be invalidated independently of the mandate that issued them

curl https://api.openfi.co/v1/session-keys \
  -H "Authorization: Bearer $OPENFI_API_KEY" \
  -d '{ "mandate_id": "man_123", "expires_in": 86400 }'

See Create a session key for the full reference.

Identity credentials

For flows that require proving an account or agent is a verified, unique, KYC’d entity, OpenFi issues W3C Verifiable Credentials (VC-JWT format), rooted at did:web:openfi.co for issuer identity and did:pkh for wallet-based subjects. See Identity overview.

Get Started

Core Concepts

Authentication

API keys

Session keys (for autonomous agents)

Identity credentials

​API keys

​Session keys (for autonomous agents)

​Identity credentials

API keys

Session keys (for autonomous agents)

Identity credentials