Authentication

Avenue uses API key authentication. Every non-auth request must include your API key in the x-api-key header.

API Key types

Key prefix	Mode	Description
`ave_live_`	Live	Real money moves. Use in production.
`ave_test_`	Test	Sandbox mode. No real money moves. Webhooks are still fired for testing.

Both keys are generated automatically when you verify your email. Access them in Settings → API Keys.

curl https://johnajayi-avenue.hf.space/v1/wallets \
  -H "x-api-key: ave_live_xxxx"

Never expose your live API key in client-side code, mobile apps, or public repositories. Use environment variables and server-side requests only.

You can rotate your API key at any time from Settings → API Keys. The old key is immediately invalidated.

If your API key is missing or invalid, Avenue returns:

{
  "detail": {
    "code": "UNAUTHORIZED",
    "message": "Invalid or missing API key."
  }
}

HTTP status: 401 Unauthorized