Authentication

How Vanta authenticates API requests with API keys and sessions.

The API base URL is https://vantapi.pancake.wtf. Server-side integrations can also configure it through the API_URL environment variable.

Authentication modes

Vanta uses two authentication modes. Which one applies depends on the route and where the request comes from.

  • API key: a project key sent in an Authorization: Bearer vk_... header. SDKs and server-to-server integrations use this mode.
  • Session: an authenticated browser session cookie. The dashboard and the project routes that back it use this mode.

Every authenticated request is scoped to exactly one project. The server resolves the project from the credentials and never trusts ownership information supplied by the client.

API keys

API keys begin with vk_ and are the tokens you send in the Authorization header:

bash
curl https://vantapi.pancake.wtf/v1/events \
  -X POST \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer vk_..." \
  -d '{"type":"purchase","data":{"product":"Premium"}}'

When a request carries an API key, the server hashes the key, resolves it to a project, and authorizes the request against that project. Use self as the project id in route paths to reference the project the key belongs to. API-key authentication applies to the event and query routes, analytics, metrics, and uptime routes under /v1/projects/:projectId/....

Using your key

Create API keys for your project from the dashboard. Each key belongs to one environment: production, development, or preview.

  • The full secret starting with vk_ is shown exactly once at creation time. Store it in your secrets manager.
  • The dashboard stores only the key prefix, the first 7 characters, which is enough to identify a key in listings and audit logs.
  • Revoked keys stop authenticating immediately.

Configure the key in your server-side SDK so it is attached to every request:

typescript
import { Vanta } from '@vanta-dev/node'

const vanta = new Vanta({
  apiKey: process.env.VANTA_API_KEY,
})

Session authentication

Routes that manage projects, members, API keys, webhooks, and pages are authenticated with an app session instead of an API key. The session is stored in a signed browser cookie, and authorization is enforced per route:

  • requireAuth: requires a valid session
  • requireProjectAccess: requires the user to own the project or be a member
  • requireProjectAdmin: requires an owner or admin role in the project

Security

The server hashes keys before storing them and never returns a full secret, server password, or database detail in any response.