Trulioo Authentication: API Security and Credentials (2026)

Authentication overview

Trulioo's API provides programmatic access to its identity verification services, enabling developers to integrate global identity checks into their applications. Secure authentication is a fundamental requirement to ensure that only authorized applications and users can access and submit data to the Trulioo platform. The primary authentication mechanism for server-to-server API calls is the use of API keys, which are unique identifiers that grant access to specific resources and functionalities within the Trulioo ecosystem. For scenarios requiring delegated authorization, Trulioo also supports OAuth 2.0 flows, allowing third-party applications to act on behalf of a user without exposing their credentials directly.

All API requests to Trulioo's endpoints must be authenticated to prevent unauthorized access and protect sensitive identity data. Failure to provide valid credentials or incorrect authentication headers will result in rejected requests. Trulioo emphasizes the importance of secure credential handling and transmission, aligning with industry best practices for API security. Detailed instructions and best practices for securing your integration can be found within the official Trulioo developer documentation.

Supported authentication methods

Trulioo supports several authentication methods to accommodate different integration patterns and security requirements. The choice of method typically depends on the type of application and the nature of the interaction with the Trulioo API.

API Keys

API keys serve as the primary method for authenticating direct server-to-server API calls. An API key is a unique, secret token that identifies your application and authorizes it to access Trulioo's services. When making a request, the API key is typically included in the HTTP Authorization header. This method is straightforward to implement and suitable for backend services that directly interact with Trulioo without user intervention.

OAuth 2.0

For scenarios requiring delegated authorization, where a third-party application needs to access Trulioo on behalf of a user, Trulioo supports OAuth 2.0. OAuth 2.0 is an industry-standard protocol for authorization that allows an application to obtain limited access to a user's resources without giving away the user's credentials. This is particularly useful for integrations where user consent is required, or where a service needs to act on behalf of a user in a secure and controlled manner. The specific OAuth 2.0 flows supported by Trulioo, such as the Client Credentials grant or Authorization Code grant, are detailed in the Trulioo API reference.

The following table summarizes Trulioo's supported authentication methods:

Getting your credentials

To begin integrating with the Trulioo API, you will need to obtain your API credentials. This process typically involves registering for a Trulioo developer account and creating an application within their developer portal.

1. Sign Up for a Developer Account: Navigate to the Trulioo Developer Portal and sign up for an account. This provides access to documentation, sandbox environments, and credential management tools.
2. Create an Application: Within your developer account, you will typically create a new application or project. This step registers your integration with Trulioo.
3. Generate API Keys: For API key authentication, the developer portal will provide an option to generate new API keys. These keys are unique to your application and environment (e.g., sandbox vs. production). It is critical to store these keys securely and treat them as sensitive information.
4. Configure OAuth 2.0 (if applicable): If you plan to use OAuth 2.0, you will typically obtain a Client ID and Client Secret when setting up your application. You may also need to configure redirect URIs for authorization flows.
5. Access Sandbox Environment: Trulioo provides a sandbox environment where you can test your API integrations without affecting live data or incurring charges. Your sandbox API keys or OAuth credentials will be separate from your production credentials.

Always ensure you are using the correct credentials for the target environment (sandbox or production) to avoid unexpected behavior or security issues.

Authenticated request example

Here's an example of how to make an authenticated request to a Trulioo endpoint using an API key in the Authorization header. This Python example uses the requests library to demonstrate a simple API call. For more complex interactions or specific endpoint details, refer to the Trulioo API reference documentation.

import requests
import json

# Replace with your actual Trulioo API Key
TRULIOO_API_KEY = "YOUR_TRULIOO_API_KEY"

# Trulioo API base URL (use sandbox for testing)
BASE_URL = "https://api.globalgateway.trulioo.com/sandbox/"

# Example endpoint: Get all countries (adjust as needed)
ENDPOINT = "configuration/v1/countries"

headers = {
    "Content-Type": "application/json",
    "Authorization": f"Basic {TRULIOO_API_KEY}"
}

try:
    response = requests.get(f"{BASE_URL}{ENDPOINT}", headers=headers)
    response.raise_for_status()  # Raise HTTPError for bad responses (4xx or 5xx)

    data = response.json()
    print(json.dumps(data, indent=2))

except requests.exceptions.HTTPError as http_err:
    print(f"HTTP error occurred: {http_err}")
    print(f"Response content: {response.text}")
except requests.exceptions.ConnectionError as conn_err:
    print(f"Connection error occurred: {conn_err}")
except requests.exceptions.Timeout as timeout_err:
    print(f"Timeout error occurred: {timeout_err}")
except requests.exceptions.RequestException as req_err:
    print(f"An unexpected error occurred: {req_err}")

In this example, YOUR_TRULIOO_API_KEY should be replaced with an actual API key obtained from your Trulioo developer account. The Authorization: Basic header is a common pattern, though some APIs might use a custom header or a bearer token for OAuth 2.0. Always consult the specific API endpoint documentation for the exact header format required.

Security best practices

Adhering to security best practices is crucial when integrating with any API, especially one that handles sensitive identity data like Trulioo. Implementing robust security measures helps protect your credentials, your customers' data, and maintain compliance.

• Secure API Key Storage: Never hardcode API keys directly into your application's source code. Instead, use environment variables, secret management services (e.g., AWS Secrets Manager, Azure Key Vault, Google Secret Manager), or secure configuration files. This prevents keys from being exposed in version control systems or publicly accessible repositories. For more information on secure secret management, refer to Google Cloud's secrets management documentation.
• Use HTTPS/TLS: Always ensure all communication with the Trulioo API occurs over HTTPS (TLS). This encrypts data in transit, protecting against eavesdropping and man-in-the-middle attacks. Trulioo's API endpoints are designed to only accept HTTPS connections.
• Least Privilege Principle: Configure your API keys or OAuth clients with the minimum necessary permissions required for your application's functionality. Avoid granting broad access if only specific operations are needed.
• Regular Key Rotation: Periodically rotate your API keys to minimize the risk associated with a compromised key. The Trulioo developer portal typically provides tools to generate new keys and revoke old ones.
• Error Handling and Logging: Implement comprehensive error handling and logging for API interactions. However, be cautious not to log sensitive information (like API keys or personally identifiable information) in plain text. Log only necessary details for debugging and auditing.
• IP Whitelisting: If Trulioo supports it, configure IP whitelisting for your API keys. This restricts API access exclusively to requests originating from a predefined set of IP addresses, adding an extra layer of security against unauthorized access.
• Monitor API Usage: Regularly monitor your API usage for any unusual patterns or spikes that could indicate unauthorized activity or a compromised key.
• Secure Client-Side Implementations: If any part of your authentication or API interaction occurs client-side (e.g., in a web browser or mobile app), ensure robust security measures are in place to prevent credential exposure or unauthorized access. For example, never expose API keys directly in client-side code.
• Stay Updated: Keep your Trulioo SDKs and any related libraries up to date to benefit from the latest security patches and features.