Authentication

All uCheck API requests are authenticated with an issued API key.

v2 Endpoints — encrypted key in the request body

The v2 endpoints expect an encrypted API key supplied inside the JSON request body:

{
  "key": "YOUR_ENCRYPTED_API_KEY"
}

The key encodes the company ID (and, for some endpoints, a creation date). The server decrypts it to resolve the company ID, which is then validated against the accounts database.

Key handling guidance

  • Treat keys as secrets: never commit them to source control or expose them client-side.

  • Keys are environment-specific — UAT keys will not work against Live and vice versa.

  • Account credentials (an account name and password) are issued when your account is first created.

  • Requests are also validated by source IP address — every connecting IP address must be registered with uCheck before use of the API.

  • UAT uses one key per Head Office (HO). Live keys are issued per organisation unit, so larger companies may receive multiple Live keys. Check with your uCheck representative if you are unsure which key applies.

  • uCheck reserves the right to change a key at any time.

  • If irregular activity is detected, uCheck may disable the associated account.

  • Contact your uCheck representative to rotate or reissue a key.

For per-endpoint request/response contracts, see the endpoint guides.