This endpoint accepts the API key in two ways:

Authorization Header (Recommended)

Authorization: Bearer sk_test_abc123...

Request Body

{"api_key": "sk_test_abc123..."}

Success Response (valid: true)

Field	Description
valid	`true` - API key is valid and partner is active
partner.partner_id	Unique partner identifier (UUID)
partner.partner_name	Organisation name
partner.status	Account status: `active`, `pending`, `suspended`, `inactive`
partner.environment	API key environment: `sandbox` or `production`
partner.social_proof_enabled	Whether social proof features are enabled
request_id	Unique request identifier for debugging
timestamp	ISO 8601 timestamp

Failed Response (valid: false)

Field	Description
valid	`false` - Validation failed
error.code	Machine-readable error code
error.message	Human-readable error message
partner	Partial partner info (if key exists but partner inactive)

Error	Code	Description
AUTH_ERROR	400/401	Missing, invalid, or malformed API key
TOKEN_EXPIRED	401	API key has expired
PARTNER_NOT_APPROVED	403	Partner account is pending approval
PARTNER_SUSPENDED	403	Partner account has been suspended
PARTNER_INACTIVE	403	Partner account is deactivated
INTERNAL_ERROR	500	Server error during validation

Status	Description
active	Partner is approved and can use the API
pending	Account is awaiting approval
suspended	Account has been temporarily suspended
inactive	Account has been deactivated

This endpoint does not require authentication (it IS the validation endpoint)
Rate limiting applies to prevent brute force attacks
Invalid API keys don't reveal whether they exist or are simply wrong
Always use HTTPS to protect API keys in transit

Cache validation results: Cache successful validations for 5-15 minutes to reduce latency
Handle all status codes: Implement proper error handling for 400, 401, 403, and 500
Use Authorization header: Preferred over request body for security and REST conventions
Log request_id: Save request_id for debugging and support inquiries
Monitor failed validations: Track failed attempts to detect security issues