Authentication

API keys

Server integrations use an institution API key. Send it as Authorization: Bearer {key} or as X-Api-Key.

curl -X POST https://app.pacinnetwork.com/api/v1/score \
  -H "Authorization: Bearer pk_test_..." \
  -H "Content-Type: application/json" \
  -d '{ "entity_id": "pac_KE_0001" }'

Dashboard sessions

People who sign in to the PACIN console use a session token. That token is for the dashboard, not for your backend integrations — do not use it in server-to-server API calls.

If auth fails

Missing or bad credentials return 401 with AUTHENTICATION_REQUIRED. A valid key without the right permission returns 403.