Authentication

Authenticate every request with an API key.

Keys have the format corvo_test_ or corvo_live_ followed by 40 lowercase hexadecimal characters.

The full key is displayed only at creation.

Headers

Header	Usage
`X-API-Key`	Required for key authentication.
`Content-Type: application/json`	JSON bodies.
`Idempotency-Key`	Optional on issuance and email requests; recommended for safe retries of those operations.

Certificate upload uses multipart/form-data. With curl -F, let curl generate the Content-Type with the boundary. Downloads return PDF or XML with no JSON envelope.

Environments

Companies, certificates and invoices are accessed in the key's persisted environment: test or live.
In live, issuance verifies the company, blocks and active certificate; credits and issuance limits also apply.
In test, issuance requires an existing company but skips the readiness and certificate checks of the live flow.
Webhook deliveries use the explicit ?environment=test|live filter; without it, they may return both of the account's environments, regardless of the key's environment.

Credits, plan and webhook settings belong to the account. A test key with full_access can manage webhooks and read credits and billing. Plan changes, checkout and the billing portal exist only in the dashboard.

The server resolves the account from authentication; resources of another account return 404.

Scopes

Code used in this reference	Scope
F	`full_access`
I	`invoices_issue`
V	`invoices_view`
RW	`invoices_read_write`

F accepts every operation listed. I allows issuing and requesting email. V allows fetching invoices, documents, events and download URLs. RW combines invoice issuance and fetching, company fetching, certificate listing, and fetching of webhooks/deliveries/statistics. RW does not allow modifying companies, certificates, webhooks, credits or plans. Even F only reaches API-key-enabled routes; scope permissions do not open other routes.

Example

bash

export BASE_URL='https://api.corvo.tech/v1'
export CORVO_API_KEY='corvo_test_your_key'

curl "$BASE_URL/companies" -H "X-API-Key: $CORVO_API_KEY"