Cloak API

Authentication

Every request carries your key. Either header is accepted.

Headers

Authorization: Bearer <api-key>
X-Api-Key: <api-key>

Create keys in the Partner Portal

Create credentials from the API Keys page at partners.veilo.network after signing in and completing your partner profile. Treat every API key as an opaque credential; do not parse it or depend on its format.

Copy the complete key before closing

The creation or rotation dialog is the only place the complete credential is displayed. Store it in your server-side secret manager before closing the dialog. It cannot be shown again later.

Rotation and revocation

Rotation creates a replacement, displays it once, and revokes the current key in the same operation. Update your server with the replacement immediately. Rotation and revocation require recent password confirmation; creating an additional key does not.

Every auth failure looks alike

Missing, unknown, revoked and disabled keys all return an identical 401 UNAUTHORIZED, deliberately. The response does not tell an attacker which one they hit, so a probe cannot distinguish “this key does not exist” from “this key exists but is switched off”.

Do not blindly retry a 401. Confirm that the credential is active, belongs to this relayer environment, and that your partner integration has been enabled.
If a key stops working and you did not rotate it, contact us rather than reissuing blindly.

Handling your key

Server-side only. A Cloak key can create orders and nominate a fee wallet. It does not belong in a browser bundle or a mobile binary.
An API key can nominate only a fee wallet already registered to your partner account. Wallet registration and removal happen in the portal and require recent password confirmation. See Partner setup.
Rate limits are keyed to your account rather than your IP, so a leaked key is also visible as unexplained traffic in your own limit headers. See Limits.