Authentication
Insurance-as-a-Service authentication follows the QI Tech signed-request standard — the same one used in Lending-as-a-Service, Banking-as-a-Service and QI DTVM. If you already integrate any other QI Tech product line, the mechanism is identical; only the host changes.
Signed request
Every request must use HTTPS with TLS 1.2 or 1.3 and carry two headers:
| Header | Description |
|---|---|
API-CLIENT-KEY | A key provided by the QI Tech Integration team that identifies your integration. |
AUTHORIZATION | A JWT-standard signature of the request, generated with your private key. |
QI Tech uses asymmetric keys: you generate a key pair, sign each request with your private key, and QI Tech validates the signature with your public key.
The complete walkthrough — generating the key pair, registering the public key on the portal and building the AUTHORIZATION header — is described in:
The private key is for the integrating partner's exclusive use and must be stored securely. QI Tech will never, under any circumstance, ask you to share it.
Receiving webhooks
Order and policy events are delivered to the callback URL configured for your integration. To configure the URL, follow Configuring Webhooks.
QI Tech webhooks follow a standard structure:
{
"webhook_type": "<event_type>",
"webhook_datetime": "2026-07-16T14:03:22Z",
"data": {}
}
| Field | Type | Description |
|---|---|---|
webhook_type | string | Identifier of the event type. |
webhook_datetime | string | Date and time of the event in ISO 8601. |
data | object | Event-specific data. |
The events available in this product line are described in Order Webhooks and Policy Webhooks.
QI Tech webhooks must not be mapped strictly. Additional fields may be added to the webhook payloads returned by our APIs.