Authentication
Insurance-as-a-Service authentication follows the QI Tech signed-request standard — the same one used in Lending-as-a-Service, Banking-as-a-Service and QI DTVM. If you already integrate any other QI Tech product line, the mechanism is identical; only the host changes.
Signed request
Every request must use HTTPS with TLS 1.2 or 1.3 and carry two headers:
| Header | Description |
|---|---|
API-CLIENT-KEY | A key provided by the QI Tech Integration team that identifies your integration. |
AUTHORIZATION | A JWT-standard signature of the request, generated with your private key. |
QI Tech uses asymmetric keys: you generate a key pair, sign each request with your private key, and QI Tech validates the signature with your public key.
The complete walkthrough — generating the key pair, registering the public key on the portal and building the AUTHORIZATION header — is described in:
The private key is for the integrating partner's exclusive use and must be stored securely. QI Tech will never, under any circumstance, ask you to share it.
Receiving webhooks
Order and policy events are notified through webhooks signed by QI Tech, at the webhook URL configured for your integration. The structure of the webhooks, the headers and how to respond are in Configuring webhooks; signature verification is in Webhook validation.