Every request to the Geldstuck API is authenticated with an API key pair. Every request to a tenant-scoped endpoint must include your API key pair:
HeaderValue
x-api-keyYour publishable key, e.g. pk_live_...
x-api-secretYour secret key, e.g. sk_live_...
Content-Typeapplication/json
The tenant is resolved automatically from the key pair - you never pass tenantId in the URL or body. See Authentication concepts for the full model - key types, rotation, and SSO.

​
Example

curl https://api.geldstuck.com/v1/tenants/me \
  -H "x-api-key: pk_live_51H..." \
  -H "x-api-secret: sk_live_51H..."
A successful request returns 200 with the tenant profile: 
{
  "tenantId": "tnt_01HX3Z8MQW...",
  "name": "Acme Escrow",
  "status": "active",
  "createdAt": "2026-04-22T09:12:44.000Z"
}

​
Errors

StatusCodeCause
401key_missingBoth headers must be present.
401key_invalidKey pair doesn’t match an active key.
401key_revokedKey was revoked. Use a new one.
403key_forbiddenKey lacks permission for this action.