> ## Documentation Index > Fetch the complete documentation index at: https://docs.didit.me/llms.txt > Use this file to discover all available pages before exploring further. # 应用凭证 API：获取 client_id 与 api_key > 通过 Get Credentials API 获取 Didit 应用的 client_id 和 api_key。将 api_key 作为 x-api-key 请求头，用于所有验证 API 调用。按量付费，无需签约。 获取应用凭据提示词 将提示词复制到剪贴板 \

\`Read one application's full record — including its client_id and api_key (client_secret). Use this to RECOVER an api_key you've misplaced.

Endpoint:
GET https://apx.didit.me/auth/v2/organizations/me/{org_id}/applications/{app_id}/

Authentication:
Authorization: Bearer 
Get a token via POST /programmatic/login/.

Path parameters:
\- org_id (UUID, required) — Organization that owns the application. Get via GET /organizations/me/.
\- app_id (UUID, required) — Application UUID. Returned by POST /programmatic/verify-email/ (in the application.uuid field), by POST /organizations/me/{org_id}/applications/, or visible in the Didit console.

curl example:
curl "https://apx.didit.me/auth/v2/organizations/me//applications//" \
-H "Authorization: Bearer "

Response (200 OK):
\{
"uuid": "b2c3d4e5-6789-...",
"name": "My App",
"client_id": "S9LIYGSoWNuGMLHsvEt9dQ",
"api_key": "sk_live_example_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",
"website_url": "https://example.com",
"redirect_uris": ["https://example.com/callback"],
"terms_url": "https://example.com/terms",
"privacy_url": "https://example.com/privacy",
"description": "Production application",
"created_at": "2025-06-01T10:00:00Z",
"data_location": "eu",
"products": [
\{ "product": "identity", "status": "enabled", "modules": { "user_verification": true, "business_verification": true, "case_management": true } },
\{ "product": "transactions", "status": "disabled", "modules": { "travel_rule": true, "case_management": true } },
\{ "product": "authentication", "status": "disabled", "modules": {} }
]
}

How to use the response:
\- api_key → set as the x-api-key header on EVERY call to https://verification.didit.me/v3/... (sessions, workflows, questionnaires, AML monitoring, billing, etc.).
\- client_id → shown alongside api_key for OAuth-style introspection scenarios. Routine verification calls only need api_key.
\- data_location → where the application's verification data is stored and processed: "eu" (European Union, Ireland). Chosen when the application is created; "au" (Australia, Sydney) and "mx" (Mexico) are coming soon.
\- products → read-only. Always all three products in this order: identity, transactions, authentication. Each has a status (enabled, early_access or disabled) and its module switches (true or false). identity modules: user_verification, business_verification, case_management. transactions modules: travel_rule, case_management. authentication has none ({}).

Failure modes:
\- 401: { "detail": "Invalid access token" } or { "detail": "Expired access token" } when the token is malformed or expired.
\- 403: { "detail": "Only organization owners and admins can manage applications." } when you are a member of the organization but not an owner or admin.
\- 403: { "detail": "Your access to this organization is suspended." } when your membership in the organization is suspended.
\- 403: { "detail": "You do not have permission to perform this action." } when the request has no Authorization header.
\- 404: { "detail": "Organization not found." } when the organization does not exist or you are not a member of it, or { "detail": "Application not found." } when the application is not in that organization.

When to call:
\- After programmatic login from a new machine — you have an access_token but not the api_key, and you need x-api-key to start calling verification.didit.me.
\- Auditing your applications — list all apps with GET /organizations/me/{org_id}/applications/, then read each.

Note:
This endpoint does not rotate the credential. It returns the application's current api_key on every GET, so there is no "show api_key once" model.

For end-to-end Didit integration, paste in the full prompt at /integration/integration-prompt.`

\
粘贴到 ## OpenAPI ````yaml zh/openapi-auth.json GET /organizations/me/{org_id}/applications/{app_id}/ openapi: 3.0.0 info: version: 1.0.0 title: Didit Auth API description: >- 面向开发者和 AI 代理的程序化注册与认证 API。仅需 2 次 API 调用即可完成注册，无需浏览器。对代理最友好的身份证件验证平台。 ## Base URL 本规范中的所有 endpoint 均托管在 `https://apx.didit.me/auth/v2`。该主机与验证 API（`https://verification.didit.me/v3`）不同。请务必区分它们：此认证主机负责签发您的 **JWT 访问 token**，并允许您列出和管理您的**组织**与**应用**。验证主机则是您调用会话、工作流、AML 等服务的地方，使用此 API 返回的 **`api_key`** 进行身份验证。 ## 认证流程运作方式 1. `POST /programmatic/register/`：提交邮箱 + 密码。 2. 通过电子邮件接收 6 位字母数字验证码。 3. `POST /programmatic/verify-email/`：提交验证码。您将获得 JWT `access_token`、`refresh_token`、一个组织以及带有 `client_id` + `api_key` 的默认应用。 4. 保存 `api_key`。在对 `https://verification.didit.me/v3/...` 的每次调用中将其作为 `x-api-key` 使用。 5. 在将来的任何机器上，`POST /programmatic/login/` 都可以用您的邮箱 + 密码换取全新的 JWT，然后调用 `GET /organizations/me/` 和应用 endpoint 来恢复或轮换凭据。 JWT 仅在用于本规范中的**账户管理** endpoint 时需要；验证 API 的流量使用的是长期有效的 `api_key`，而非 JWT。 ## 约定 - 所有请求体和响应体均为 JSON（`Content-Type: application/json`）。 - **在测试 `POST /programmatic/register/` 时，请使用真实、可投递的电子邮件地址。** 该 endpoint 会同步发送验证码，因此保留测试域名（`@example.com`、`@example.org`、`@*.test`、`@*.example`、`@*.invalid`）的地址将被邮件发送系统拒绝，且请求将返回 `500`。请将示例中的占位符 `you@yourdomain.com` 替换为您实际可以查收的收件箱。 - 验证错误返回 HTTP `400`，具有以下两种外层结构之一：针对字段级问题的 `{"field": ["message", ...]}`，或针对业务规则错误的 `{"detail": "message"}`。少数验证器（注册时的密码强度、验证邮箱时的验证码过期）目前会响应纯数组 `["message"]` 而不是以字段为键的形式，这是已知的服务端不一致性，因此客户端代码应同时支持这两种结构。 - 身份验证错误将作为 `{"detail": "..."}` 返回，状态码为 HTTP `401`（无效的 bearer token）或 `403`（缺少 bearer token / 权限不足）。 - 速率限制响应包含一个以秒为单位的冷却时间字段 `wait`。 servers: - url: https://apx.didit.me/auth/v2 description: 生产环境认证服务器 security: [] tags: - name: Programmatic Auth description: >- 邮箱和密码账户生命周期：注册、验证、登录。返回用于访问账户管理 endpoint 的 JWT `access_token`，并在验证通过时一并返回您首个应用的 `client_id` 和 `api_key`。 - name: Account Management description: >- 用于列出组织以及创建、获取或更新应用的经认证 endpoint（JWT bearer）。使用这些 endpoint 可以恢复或轮换用于验证 API 调用身份的 `api_key`。 paths: /organizations/me/{org_id}/applications/{app_id}/: get: tags: - Account Management summary: 获取应用凭证 description: 读取单个应用的完整记录，包括 `client_id` 和 `api_key`。可用于找回丢失的 `api_key`。 operationId: get_application_credentials parameters: - name: org_id in: path required: true description: 拥有该应用的组织的 UUID。 schema: type: string format: uuid example: a1b2c3d4-5678-90ab-cdef-111111111111 - name: app_id in: path required: true description: 您想要读取其凭据的应用的 UUID。 schema: type: string format: uuid example: b2c3d4e5-6789-01bc-defg-222222222222 responses: '200': description: 包含其 `client_id` 和 `api_key` 的应用记录。 content: application/json: schema: $ref: '#/components/schemas/Application' examples: Success: value: uuid: b2c3d4e5-6789-01bc-defg-222222222222 name: My App client_id: S9LIYGSoWNuGMLHsvEt9dQ api_key: sk_live_example_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx website_url: https://example.com redirect_uris: - https://example.com/callback terms_url: https://example.com/terms privacy_url: https://example.com/privacy description: Production application created_at: '2025-06-01T10:00:00Z' data_location: eu products: - product: identity status: enabled modules: user_verification: true business_verification: true case_management: true - product: transactions status: disabled modules: travel_rule: true case_management: true - product: authentication status: disabled modules: {} '401': description: 访问 token 格式错误、无效或已过期。请使用 `POST /programmatic/login/` 获取新 token。 content: application/json: schema: $ref: '#/components/schemas/AuthError' examples: InvalidToken: value: detail: Invalid access token ExpiredToken: value: detail: Expired access token '403': description: >- 您无法读取此应用。非所有者或管理员的组织成员将收到 `Only organization owners and admins can manage applications.`。对组织的访问权限被暂停的所有者或管理员将收到 `Your access to this organization is suspended.`。不带 `Authorization` 请求头的请求将收到 `You do not have permission to perform this action.`。 content: application/json: schema: $ref: '#/components/schemas/AuthError' examples: NotOwnerOrAdmin: summary: 非所有者或管理员的成员 value: detail: >- Only organization owners and admins can manage applications. Suspended: summary: 成员资格已暂停 value: detail: Your access to this organization is suspended. MissingToken: summary: 无 Authorization 请求头 value: detail: You do not have permission to perform this action. '404': description: 组织不存在，或者您不是该组织的成员，亦或应用在该组织中不存在。 content: application/json: schema: $ref: '#/components/schemas/AuthError' examples: OrganizationNotFound: summary: 未找到组织，或者您不是该组织的成员 value: detail: Organization not found. ApplicationNotFound: summary: 该组织中不存在此类应用 value: detail: Application not found. security: - BearerAuth: [] x-codeSamples: - lang: curl label: cURL source: >- curl "https://apx.didit.me/auth/v2/organizations/me/$ORG_ID/applications/$APP_ID/" \ -H "Authorization: Bearer $ACCESS_TOKEN" - lang: python label: Python source: |- from didit import Didit # Use the access token that account.login returns. client = Didit(account_token="YOUR_ACCESS_TOKEN") result = client.account.applications.retrieve( "a1b2c3d4-5678-90ab-cdef-111111111111", "b2c3d4e5-6789-01bc-defg-222222222222", ) print(result) - lang: javascript label: Node.js source: |- import Didit from "@didit-protocol/sdk-node"; // Use the access token that account.login returns. const didit = new Didit({ accountToken: "YOUR_ACCESS_TOKEN" }); const result = await didit.account.applications.retrieve( "a1b2c3d4-5678-90ab-cdef-111111111111", "b2c3d4e5-6789-01bc-defg-222222222222", ); console.log(result); - lang: go label: Go source: "ctx := context.Background()\n// Use the access token that account.login returns.\nclient := didit.NewClient(option.WithAccountToken(\"YOUR_ACCESS_TOKEN\"))\n\nresult, err := client.Account.Applications.Retrieve(ctx, \"a1b2c3d4-5678-90ab-cdef-111111111111\", \"b2c3d4e5-6789-01bc-defg-222222222222\")\nif err != nil {\n\tlog.Fatal(err)\n}\nfmt.Printf(\"%+v\\n\", result)" - lang: java label: Java source: >- import me.didit.Didit; // Use the access token that account.login returns. Didit client = Didit.builder().accountToken("YOUR_ACCESS_TOKEN").build(); var result = client.account().applications().retrieve("a1b2c3d4-5678-90ab-cdef-111111111111", "b2c3d4e5-6789-01bc-defg-222222222222"); System.out.println(result); - lang: php label: PHP source: >- account->applications->retrieve('a1b2c3d4-5678-90ab-cdef-111111111111', 'b2c3d4e5-6789-01bc-defg-222222222222'); print_r($result->toArray()); - lang: ruby label: Ruby source: |- require "didit" # Use the access token that account.login returns. didit = Didit::Client.new(account_token: "YOUR_ACCESS_TOKEN") result = didit.account.applications.retrieve( "a1b2c3d4-5678-90ab-cdef-111111111111", "b2c3d4e5-6789-01bc-defg-222222222222" ) puts result.to_h - lang: csharp label: .NET source: >- using System; using System.Text.Json; using Didit; // Use the access token that account.login returns. using var client = new DiditClient(new DiditClientOptions { AccountToken = "YOUR_ACCESS_TOKEN" }); var result = await client.Account.Applications.RetrieveAsync("a1b2c3d4-5678-90ab-cdef-111111111111", "b2c3d4e5-6789-01bc-defg-222222222222"); Console.WriteLine(JsonSerializer.Serialize(result)); components: schemas: Application: type: object description: >- 完整应用记录。`uuid`、`client_id` 和 `api_key` 在创建后永不更改。`data_location` 同样不会更改，除非在随您的组织创建的生产环境应用被投入使用之前修改一次（参见更新请求）。 properties: uuid: type: string format: uuid description: 应用 UUID。在后续调用中用作 `{app_id}`。 example: b2c3d4e5-6789-01bc-defg-222222222222 name: type: string description: 在 Didit 控制台中显示的应用显示名称。 example: Acme Production App client_id: type: string description: 公开客户端标识符，可安全嵌入 OAuth 风格的流程中。 example: S9LIYGSoWNuGMLHsvEt9dQ api_key: type: string description: >- 长期有效的密钥（也称为 `client_secret`）。在对 `https://verification.didit.me/v3/...` 的每次调用（会话、工作流、AML 等）中作为 `x-api-key` 请求头使用。请妥善作为凭据保管，切勿在客户端暴露。新密钥以 `sk_live_`（生产环境应用）或 `sk_test_`（沙盒应用）开头，后接 43 个 URL 安全字符（字母、数字、`-` 和 `_`）。在此格式之前创建的密钥没有前缀，仍可继续使用。在恢复账户后的 72 小时内，此处的列表、检索和更新接口将返回空字符串而不是密钥。 example: sk_live_example_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx website_url: type: string nullable: true description: 与此应用关联的网站或应用 URL。 example: https://acme.example redirect_uris: type: array items: type: string description: OAuth 风格及验证重定向流程允许的重定向 URI。 example: - https://acme.example/callback terms_url: type: string nullable: true description: 在验证流程中显示的服务条款 URL。 example: https://acme.example/terms privacy_url: type: string nullable: true description: 在验证流程中显示的隐私政策 URL。 example: https://acme.example/privacy description: type: string nullable: true description: 应用的内部描述（不对终端用户显示）。 created_at: type: string format: date-time example: '2025-06-01T10:00:00Z' data_location: $ref: '#/components/schemas/ApplicationDataLocation' products: type: array readOnly: true description: >- 该应用的产品。始终包含全部三项，顺序如下：`identity`、`transactions`、`authentication`。新创建的应用会默认启用 `identity` 及其所有模块，并禁用 `transactions` 和 `authentication`。只读：创建或更新请求体中的 `products` 键将被忽略。 items: $ref: '#/components/schemas/ApplicationProduct' example: - product: identity status: enabled modules: user_verification: true business_verification: true case_management: true - product: transactions status: disabled modules: travel_rule: true case_management: true - product: authentication status: disabled modules: {} AuthError: type: object description: 认证 / 授权 / 未找到错误响应封装。 properties: detail: type: string example: Invalid access token ApplicationDataLocation: type: string enum: - eu - au - mx description: >- 应用验证数据的存储和处理位置，在创建应用时选择。`eu` 为欧盟（爱尔兰），即默认值。`au`（澳大利亚，悉尼）和 `mx`（墨西哥）即将推出：指定这些位置的请求将返回 400 `This data location is not available yet.`。组织的沙盒应用始终位于欧盟。 example: eu ApplicationProduct: type: object description: 应用的一个产品及其状态。只读：应用相关 endpoint 会返回该字段，并在请求体中忽略它。 properties: product: type: string enum: - identity - transactions - authentication description: '`identity`（身份证件验证）、`transactions`（交易监控）或 `authentication`（身份验证）。' example: identity status: type: string enum: - enabled - early_access - disabled description: 该产品是否已为该应用开启。`early_access` 仅适用于 `authentication`，由 Didit 为您开启。 example: enabled modules: type: object additionalProperties: type: boolean description: >- 产品的模块开关，每个为 `true` 或 `false`。`identity` 包含 `user_verification`、`business_verification` 和 `case_management`。`transactions` 包含 `travel_rule` 和 `case_management`。`authentication` 无任何开关（`{}`）。`case_management` 是同时显示在 `identity` 和 `transactions` 下的单一设置，因此在两者上具有相同的值。 example: user_verification: true business_verification: true case_management: true required: - product - status - modules securitySchemes: BearerAuth: type: http scheme: bearer bearerFormat: JWT description: >- 由 `POST /programmatic/login/` 或 `POST /programmatic/verify-email/` 返回的 RS256 签名 JWT `access_token`。作为 `Authorization: Bearer ` 发送。默认有效期为 86400 秒（24 小时）。该 token 仅对 `apx.didit.me/auth/v2` 上的账户管理 endpoint 有效。验证 API（`verification.didit.me/v3`）改用长效的 `api_key` 作为 `x-api-key`。 ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.