---
updatedAt: 2026-08-24T09:44:22.000Z
agentTools:
  projectIndex: https://developers.burodeingresos.com/llms.txt
---

# Authentication

API key authentication, webhook signatures, IP allowlisting

All requests authenticate using an API key sent in the `X-API-Key` header.

```bash
curl https://api.burodeingresos.com/verifications \
  -H "X-API-Key: your-api-key" \
  -H "Content-Type: application/json"
```

Manage your API keys from the **Developers** section in [console.burodeingresos.com](https://console.burodeingresos.com). Keep your API key secret. Never commit it to source control, expose it in client-side code, or share it across teams.

## API Keys rotation (zero-downtime)

You can have multiple active API keys simultaneously to rotate keys without
service interruptions:

1. **Create a new key** in the **Developers** section of the console with a descriptive label.
2. **Copy and store the secret** immediately. For security reasons, the full secret is shown only once and cannot be retrieved later.
3. **Deploy the new key** to your application or environment.
4. **Verify traffic cutover** by checking the **Last used** timestamp of the previous key in the console.
5. **Revoke the previous key** once you confirm it is no longer receiving traffic.

<Callout icon="📘" theme="info">
  ### Key limits

  - You can have up to **5 active keys** per company.
  - Revoked keys do not count toward this limit.
  - You cannot revoke your **last active key** (at least one active key is required at all times).
</Callout>

## Transport security

All Buró de Ingresos endpoints require **TLS 1.3**. Connections using older TLS versions are rejected.

<br />

## Webhook signatures

Every webhook event includes an `X-Signature` header computed as HMAC SHA-256 over the raw body using your `secret_key`. See [Webhooks](https://developers.burodeingresos.com/docs/webhooks#verify-webhook-signatures) for the verification procedure and a Node.js example.

<br />

## Outbound IP allowlisting

If your webhook endpoint restricts inbound traffic by IP, fetch the current outbound IP list from `GET /outbound_ips`. See the [Get Outbound IP Addresses API reference](https://developers.burodeingresos.com/reference/getoutboundips) for the response shape and the [Webhooks](https://developers.burodeingresos.com/docs/webhooks#ip-whitelisting) guide for recommended refresh cadence.

<br />

## Status and availability

Real-time API status, incidents, and scheduled maintenance are published at [status.burodeingresos.com](https://status.burodeingresos.com).

<br />

## Compliance

Buró de Ingresos is certified under [ISO-27001](https://palenca.com/mx/seguridad). All personal data is processed in compliance with the Mexican Federal Law on Protection of Personal Data Held by Private Parties (LFPDPPP).