Get API keys

Security

Last updated Aug 4, 2026

Every request is bound to a key, a device, and — for sensitive work — an explicit confirmation. Nothing here needs configuration; it is how the SDK and engine behave by default.

API keys

Every app needs a Voqal API key (pk_live_…), set on config.apiKey and sent as X-Voqal-Key. We issue one per integrator — requests without a valid key are rejected.
The key is publishable: it identifies your tenant, while your end user’s auth token (supplied live by your delegate) authorizes each request against your backend.

Signed sessions

Each session establishes a device key in the Secure Enclave and signs every request (proof-of-possession), so a leaked session token is useless without the device.
Session tokens refresh automatically and silently — no error is ever shown to the user.

Confirm-first actions

Money-movement actions are never executed inline — they surface a confirm card first, rendered by the SDK inside the conversation.
High-risk actions (for example instant settlement) additionally require Face ID; lower-risk ones (creating a payment link) are a single tap.

Diagnostics

The SDK includes built-in crash and error reporting so issues are detected and resolved quickly. It works automatically — no setup required.
It is privacy-preserving: auth tokens and personal data are never sent. You may wish to note the presence of in-app diagnostics in your privacy policy.