Sift Authentication: API Keys, Setup, and Best Practices (2026)

Authentication overview

Sift employs API keys as its primary method for authenticating requests to its platform. This approach ensures that all interactions with the Sift API, whether sending event data for fraud analysis or querying existing scores, originate from a verified source. API keys serve as unique identifiers for your application or service, granting access to your Sift account's resources and data. All communication with Sift's API must occur over HTTPS, providing encryption in transit to protect sensitive information and API keys from interception. This adherence to secure communication protocols is a standard practice in API security, as detailed in the IETF's HTTPS specification.

When integrating with Sift, developers typically embed these API keys within their server-side applications. Sift's official documentation provides comprehensive guides for setting up and utilizing these keys across various programming languages and SDKs, including Python, Node.js, Java, PHP, and Ruby. The authentication process is straightforward: the API key is included in the header or body of each API request, allowing Sift to validate the request's origin before processing.

The system is designed to handle high volumes of transaction data, requiring a robust authentication mechanism that is both secure and efficient. API keys, when managed correctly, fulfill this requirement by offering a balance between ease of implementation and strong access control. Sift recommends different API keys for different environments (e.g., development, staging, production) to further segment access and minimize potential risks, enhancing overall security posture.

Supported authentication methods

Sift primarily supports API key authentication for programmatic access to its services. This method is suitable for server-to-server communication where applications make requests on behalf of an organization rather than an individual end-user. The API key acts as a secret token, identifying the client making the request.

While the Sift Javascript snippet is deployed on client-side applications (e.g., e-commerce storefronts), its purpose is to collect device and browser-related signals for fraud detection, not to authenticate direct API calls from the client. All sensitive API interactions, such as sending transaction events or retrieving fraud scores, are expected to be handled by your backend services using an API key to maintain security and prevent exposure of credentials to end-users.

Getting your credentials

To begin integrating with Sift, you will need to obtain your API key from the Sift Dashboard. The process typically involves logging into your Sift account and navigating to the API Keys section. Sift provides distinct API keys for different environments, such as a Production API Key and a Sandbox API Key. Using separate keys for development and production is a critical security practice, preventing accidental data corruption or exposure in live systems during testing phases.

1. Log In to Sift Dashboard: Access your Sift account through the official Sift homepage.
2. Navigate to API Keys: Once logged in, locate the section related to API Keys or Developer Settings. The exact path may vary slightly based on dashboard updates, but it is generally found under an 'Integrations' or 'Settings' menu.
3. Generate/Retrieve Keys: Here, you will find your existing API keys or the option to generate new ones. Sift typically provides a unique API key for your account. You may also find separate keys for different environments (e.g., a sandbox key for testing and a production key for live operations).
4. Store Securely: Once retrieved, treat your API key as a sensitive secret. Never hardcode it directly into your client-side code or commit it to public version control systems. Best practices dictate storing API keys in environment variables, secret management services, or secure configuration files.

For detailed, step-by-step instructions on where to find and manage your API keys, refer to the Sift API Basics documentation, which provides the most current guidance.

Authenticated request example

Authenticated requests to Sift typically involve including your API key in the request body, especially for event submission endpoints. The examples below demonstrate how to make an authenticated request using the curl command-line tool and a Python SDK, illustrating the inclusion of the API key.

Example using curl (HTTP POST Request)

This curl example sends an $order_status event to Sift, including the API key in the JSON payload. Replace YOUR_API_KEY with your actual Sift API key and YOUR_ACCOUNT_ID with your Sift Account ID.

curl -X POST \
  https://api.sift.com/v2.0/events \
  -H 'Content-Type: application/json' \
  -d '{
    "$api_key": "YOUR_API_KEY",
    "$type": "$order_status",
    "$user_id": "billy_jones",
    "$order_id": "ORDER-12345",
    "$order_status": "$declined",
    "$reason": "$payment_risk",
    "$sift_science_api_version": "2.0"
  }'

Example using Sift Python SDK

Sift provides official SDKs to simplify integration. The Python SDK handles the underlying HTTP requests and authentication details, making it easier to send events. First, ensure you have the Sift Python SDK installed (pip install siftscience).

import siftscience

sift = siftscience.Client(api_key="YOUR_API_KEY")

# Send an event
response = sift.track(
    "$transaction",
    {
        "$user_id": "billy_jones",
        "$session_id": "gigtrq4p9t0p1l12f45p9t0p1l12f",
        "$transaction_id": "my_transaction_id",
        "$seller_user_id": "billy_bob",
        "$amount": 1250000,
        "$currency_code": "USD",
        "$time": 1327398391,
        "$transaction_type": "$sale",
        "$status": "$success",
        "$sift_science_api_version": "2.0",
        "$billing_address": {
            "$name": "Bill Jones",
            "$address_1": "2100 Main Street",
            "$address_2": "Apt 1A",
            "$city": "New York",
            "$region": "NY",
            "$country": "US",
            "$zipcode": "10001"
        },
        "$payment_methods": [
            {
                "$payment_type": "$credit_card",
                "$card_bin": "411111",
                "$card_last4": "1111"
            }
        ],
        "$shipping_address": {
            "$name": "Bill Jones",
            "$address_1": "2100 Main Street",
            "$address_2": "Apt 1A",
            "$city": "New York",
            "$region": "NY",
            "$country": "US",
            "$zipcode": "10001"
        }
    }
)

if response.is_ok():
    print("Event sent successfully!")
else:
    print(f"Error sending event: {response.error_message}")

For more examples across different languages, consult the Sift API reference documentation.

Security best practices

Securing your Sift API integration is paramount to protecting your data and maintaining the integrity of your fraud prevention efforts. Adhering to the following best practices will help mitigate common security risks associated with API key management:

• Treat API Keys as Secrets: Your Sift API key is a highly sensitive credential. Never hardcode it directly into your application's source code, especially if that code is publicly accessible (e.g., client-side JavaScript). Instead, store API keys in environment variables, dedicated secret management services (like AWS Secrets Manager, Google Secret Manager, or Azure Key Vault), or secure configuration files that are not committed to version control.
• Use Environment-Specific Keys: Sift allows for separate API keys for different environments (e.g., development, staging, production). Utilize this feature to prevent test data from polluting production systems and to limit the blast radius in case a key is compromised in a non-production environment.
• Secure Transmission (HTTPS/TLS): Always ensure all communication with the Sift API occurs over HTTPS (TLS). This encrypts the data in transit, protecting your API key and sensitive event data from eavesdropping and man-in-the-middle attacks. Sift's endpoints enforce HTTPS by default. The Mozilla Developer Network provides a comprehensive guide to Transport Layer Security (TLS).
• Restrict Key Usage: While Sift API keys are generally broad in scope for event submission, implement network access controls (e.g., IP whitelisting) on your infrastructure where possible to restrict which servers can make calls to the Sift API. This adds an extra layer of security, ensuring only authorized servers can use your key.
• Regular Key Rotation: Periodically rotate your API keys. This practice limits the window of exposure for a compromised key. The frequency depends on your organization's security policies and risk assessment.
• Monitor API Usage: Regularly monitor your API usage logs for any unusual activity or spikes in requests that could indicate unauthorized access or a compromised key. Implement alerting mechanisms to notify you of suspicious patterns.
• Error Handling and Logging: Implement robust error handling and logging for API requests. Avoid logging raw API keys in plain text within your application logs, even for debugging purposes. Mask or redact sensitive information.
• Server-Side Integration: All direct API calls to Sift, especially those involving your API key, should originate from your secure backend servers. Avoid exposing your API key in client-side code where it can be easily inspected by end-users. Client-side data collection should be done using Sift's JavaScript snippet, which is designed for this purpose without exposing your API key directly.