Authenticating your API requests

Every call to the VehicleMatic API is authenticated with an API key.

The header

Send your key in the X-VEHICLEMATIC-KEY request header:

curl "https://vehiclematic.com/products/vehicle-details/api/live/AB12CDE" \
  -H "X-VEHICLEMATIC-KEY: your_api_key"

If the header is missing or the key is invalid, the API responds with an error and no credits are used.

The base URL and endpoint shape

All live lookups use the same pattern:

https://vehiclematic.com/products/{product-slug}/api/live/{operation}

For vehicle products the operation is the registration (VRM); for the licence product you POST the licence number and share code (see Driving Licence Check).

Key security

• Keys are hashed at rest. We store only a hash of each key plus a short prefix and the last four characters for identification — the full key is shown once, at creation, so copy it then.
• Keep keys server-side. Treat a key like a password. Never embed it in client-side code or a public repository.
• Rotate freely. You can create multiple keys and revoke any of them at any time. See Creating and scoping API keys.

A legacy X-AUTOMATE-KEY header is still accepted for older integrations, but new integrations should use X-VEHICLEMATIC-KEY.