Getting started

This guide takes you from zero to a live integration: create your org, build against sandbox, get verified, and switch to live keys.

Base URL & environments

Environment	Key prefix	Base URL (today)
Sandbox	lk_test_	https://locke-api.trylockey.workers.dev/partner/v1
Live	lk_live_	https://locke-api.trylockey.workers.dev/partner/v1

The same base URL serves both environments — the key prefix alone selects sandbox vs. live behavior.

Read the base URL from config

The brand domain trylockey.com is not yet cut over; the current origin is the Cloudflare Workers URL above. The console UI is separate (https://partners.trylockey.com). Both flip to trylockey.com once the domain is live — read the base URL from config, don't hardcode it.

From sandbox to live

1. Create the org and sign in to the partner console (Google / the console sign-in flow). Your org starts in pending.

2. Mint a sandbox key. Console → Credentials → API keys, environment sandbox. Sandbox keys work immediately, even while your org is pending. Copy the key — it is shown once.

3. Build against sandbox. Sandbox requests never resolve or contact a real person and never touch real accounts, so you can exercise the full flow safely. You can even use high-sensitivity classifications in sandbox before you're verified.

4. Get verified (KYB) and accept the DPA. Live keys are gated on two things:

   • status = active — an operator verifies your org (KYB).
   • An accepted DPA — an owner/admin accepts it on the console Overview page.

   Until both are true, minting a live key returns 409 with live_requires_verification or dpa_required.

5. Mint a live key and switch your base config over. Requesting a high-sensitivity class (see Requesting documents) on a live key additionally requires the elevated verification tier.

Smoke-test your credentials

Verify a key works before building anything else:

curl https://locke-api.trylockey.workers.dev/partner/v1/ping \
  -H "Authorization: Bearer $LOCKE_API_KEY"

{
  "ok": true,
  "partnerId": "…",
  "environment": "sandbox",
  "scopes": ["requests:write", "requests:read", "grants:read"]
}

If this returns 401 { "error": "unauthorized" }, the key is missing, unknown, revoked, expired, or the org is suspended — see Authentication.

Next: Authentication & keys →