Authentication & API Keys

API Key Types

ComplianceGrid uses prefixed API keys so you can instantly identify the environment and type at a glance.

Method 1: OAuth 2.0 Bearer Token (Recommended)

Exchange your Client ID + API key for a short-lived Bearer token. This is the recommended approach for all integrations — tokens are scoped, short-lived, and follow OAuth 2.0 best practices.

curl -X POST https://sandbox.api.compliancegrid.ai/oauth/token \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "grant_type=client_credentials" \
  -d "client_id=cg_client_your_client_id" \
  -d "client_secret=cg_sk_your_sandbox_key"

# Response:
# {
#   "access_token": "eyJhbGciOiJSUzI1NiI...",
#   "token_type": "Bearer",
#   "expires_in": 86400,
#   "scope": "compliance:read hs:read pharma:read ...",
#   "environment": "sandbox"
# }

curl -X POST https://sandbox.api.compliancegrid.ai/v1/compliance/restricted-party-screening \
  -H "Authorization: Bearer eyJhbGciOiJSUzI1NiI..." \
  -H "Content-Type: application/json" \
  -d '{"parties": [{"name": "Huawei Technologies", "country": "CN"}]}'

Method 2: Direct API Key Header (Alternative)

For quick testing, you can pass your API key directly in the x-api-key header. No token exchange required. We recommend upgrading to Bearer tokens for production use.

# Sandbox — returns mock data
curl -X POST https://sandbox.api.compliancegrid.ai/v1/compliance/restricted-party-screening \
  -H "Content-Type: application/json" \
  -H "x-api-key: cg_sk_your_sandbox_key_here" \
  -d '{"parties": [{"name": "Huawei Technologies", "country": "CN"}]}'

# Production — real government data, billed
curl -X POST https://api.compliancegrid.ai/v1/compliance/restricted-party-screening \
  -H "Content-Type: application/json" \
  -H "x-api-key: cg_pk_your_production_key_here" \
  -d '{"parties": [{"name": "Huawei Technologies", "country": "CN"}]}'

SDK Authentication

The official SDKs handle authentication and routing for you. Just pass your API key and the SDK does the rest.

import ComplianceGrid from "@compliancegrid/sdk";

// SDK auto-routes based on key prefix
const cg = new ComplianceGrid({
  apiKey: process.env.COMPLIANCEGRID_API_KEY,
});

// cg_sk_ → sandbox.api.compliancegrid.ai
// cg_pk_ → api.compliancegrid.ai

from compliancegrid import ComplianceGrid

# SDK auto-routes based on key prefix
cg = ComplianceGrid(
    api_key=os.environ["COMPLIANCEGRID_API_KEY"]
)

# cg_sk_ → sandbox.api.compliancegrid.ai
# cg_pk_ → api.compliancegrid.ai

Security Best Practices