Authentication

The GOFA Commercial API is server-to-server. Keep your API key in a trusted backend environment and use it only when your server makes a request.

Server-side only

Do not put your API key in browser code, client-side bundles, mobile apps, WebViews, URLs, or public repositories. Your backend should be the only place that reads the key and sends requests to GOFA.

Send your API key

Send the key in the Authorization header as a bearer token:

Authorization: Bearer <GOFA_API_KEY>

For example, a production request includes the same header:

curl --request GET \
  'https://www.gofa.app/api/v1/vital-scan/sessions/<vitalScanResultId>' \
  -H 'Authorization: Bearer <GOFA_API_KEY>'

Replace the placeholders with values held by your server-side configuration. The same header is used for the Vital Scan create, read, and delete endpoints.

The API accepts the exact Authorization: Bearer <GOFA_API_KEY> form. Do not send a Firebase ID token, a legacy client token, an admin token, or a client secret as a substitute.

Key handling

• Read the key from your server's secret manager or deployment environment.
• Never put it in browser code, client-side bundles, mobile apps, WebViews, URLs, logs, analytics events, or public repositories.
• Do not forward the key to the hosted Vital Scan page. The vitalScanUrl returned by the create endpoint is a separate, temporary session URL.

Get or replace a key

Sign in to the GOFA customer portal as an active administrator of your own workspace, then open API → Keys → Create API key. Choose a recognizable label and an appropriate expiry. Copy the secret directly into your backend's secret manager: it is shown only once and cannot be retrieved later.

Product activation and key creation require a customer-owned administrator session. A GOFA platform administrator viewing your workspace, or access through a linked workspace, is not a substitute. If the actions are unavailable, ask your workspace administrator or GOFA Support to check your access.

Creating a key does not activate Vital Scan. Complete the service activation in Quick Start before making requests.

For a planned replacement without an interruption:

1. Create a second key while the existing key is still active.
2. Store and deploy the new key to all backend consumers. Verify it with a GET for an existing session; do not create a paid session just to test the key.
3. Once all consumers use the new key, revoke the old key in the portal.

Rotate is immediate: it creates a replacement and revokes the old key in the same operation. There is no overlap or grace period. Use it when immediate invalidation is intended, and store the replacement secret when it is shown. If a key is exposed, revoke or rotate it promptly; do not leave a compromised key active for a planned overlap. If a secret is lost, create or rotate a replacement rather than trying to retrieve it.

If a request returns 401 invalid_api_key, check that the key is present, active, and sent in the bearer header. For entitlement or product errors, see Errors & limits.

Existing client integrations

Some existing GOFA integrations use Firebase credentials or a client token on the separate /api/auth and /api/client routes. Those credentials are not interchangeable with a Commercial API key. See Integration authentication for the client-token, Firebase user-authentication, and client-user contracts.