Skip to main content
Every request to the Zeal REST API must be authenticated with an API key issued to your partner account. Zeal uses standard HTTP Bearer token authentication - you include your key in the Authorization header of every request. There are no session tokens or cookie-based flows; each request is independently authenticated.

​
Obtaining your API keys

Your API keys live on the API page of the Partner Dashboard at app.zeal.com. You will find both a Test API key and a Production API key there, along with your partnerID. If you are logging in for the first time, click Forgot Password on the login screen to set your password. Once inside the dashboard, navigate to the API page and copy the key appropriate for your environment.

​
Passing the API key

Include the key in the Authorization header of every HTTP request:
Replace {apiKey} with your actual key. The header must appear on every request - there is no session-level authentication.

​
Example request

​
Test vs. production keys

Zeal maintains two fully isolated environments. Each has its own API key.
Use your Test API key for all development and integration work. Resources created with the Test key (companies, workers, checks) are completely isolated from Production and will not appear in the live environment.

​
The partnerID header

Some endpoints require a partnerID in addition to your API key. The partnerID identifies your Zeal partner account and is found on the same API page as your keys. It is typically passed as a request body parameter (for POST/PATCH requests) or as a query parameter (for GET requests) rather than as a header.

​
Rolling a compromised key

If you believe a key has been exposed, rotate it immediately from the API page of the Partner Dashboard. Click the refresh icon next to the compromised key and follow the on-screen prompts. The old key is invalidated instantly and a new key is issued. Update any systems that relied on the old key before the rotation.
Never commit API keys to version control, include them in client-side code, or log them to any output stream. Treat them with the same care you would a password. Grant access only to team members and services that genuinely need it.

​
Webhook authentication

When Zeal sends webhook payloads to your configured endpoints, it includes a Puzzl-Signature header containing a shared secret. You can find this secret under the Webhook secrets tab on the API page. Configure your webhook handlers to reject any request that does not include a valid Puzzl-Signature header to prevent spoofed events.