Authentication & keys
Every Partner API call carries one of your company's API keys. The key decides which company you are — you can only ever see and act on your own business.
API keys
sk_test_…keys work against the sandbox;sk_live_…keys against production.- Create them in the Insurer Portal under Settings → API Credentials. A key is shown once, at creation — store it in a secret manager, never in source code.
- Create one key per system that calls us, so you can revoke one without the others.
- A revoked key stops working immediately and cannot be restored.
Sending the key
Send it as a bearer token on every request, over HTTPS (TLS 1.2 or later). Plain-HTTP requests are refused.
curl
curl https://api-dev.sorplos.com/v1/partner-api/applications \
-H "Authorization: Bearer sk_test_..."Sandbox first
A company that registers itself gets sandbox keys only. Build and test against the sandbox with synthetic customers; live keys are issued once Sorplos has reviewed and approved your company.
| Environment | Base URL | Keys | Data |
|---|---|---|---|
| Sandbox | https://api-dev.sorplos.com/v1/partner-api | sk_test_ | synthetic |
| Production | Announced with go-live | sk_live_ | real customers |
Rotating a key
- Create a new key.
- Deploy it everywhere the old one is used — both keys work in the meantime.
- Revoke the old key once its "last used" time stops moving.
IP allow-listing
Optional, in both directions. Give Sorplos your servers' outbound IP addresses and we will refuse your keys from anywhere else. Sorplos publishes the addresses its webhooks come from, so you can allow only those on your firewall.