Skip to main content
Different API endpoints use different authentication methods depending on the caller.

​
SDK / Mobile app

The iOS SDK authenticates using Bundle ID + Team ID headers. No API keys are sent from the device. 
X-Bundle-ID: com.yourapp.example
X-Team-ID: ABBM6U9RM5
These headers are sent automatically by the SDK. Used by: Attestation, Feedback, Support, Feature Flags.

​
Server-to-server

For backend integrations (analytics, VRT CLI), use an API key: 
# Header style
curl -H "X-API-Key: aat_your_api_key" https://grantiva.io/api/v1/analytics/dashboard

# Or Bearer style
curl -H "Authorization: Bearer aat_your_api_key" https://grantiva.io/api/v1/analytics/dashboard
API keys are created in the dashboard under Settings.
PrefixType
aat_Organization API key
gpat_Personal API key
grantiva_Legacy key format

​
JWT token

After successful attestation, the SDK receives a JWT token. Protected endpoints require this token: 
curl -H "Authorization: Bearer eyJhbGciOi..." https://grantiva.io/api/v1/heartbeat

​
Admin API

For internal admin operations: 
curl -H "X-Admin-API-Key: your_admin_key" https://grantiva.io/admin/v1/tenants
# Or
curl -H "Authorization: Admin your_admin_key" https://grantiva.io/admin/v1/tenants

​
Summary

Endpoint groupAuth methodWho uses it
Attestation, Feedback, FlagsBundle ID + Team ID headersiOS SDK
Analytics, VRTAPI keyYour backend, CLI
Protected routesJWT tokeniOS SDK (post-attestation)
AdminAdmin API keyInternal tooling