Authentication

How requests are authorized and how CORS is configured.

API keys

PrevIQ supports an optional API key sent via the X-API-Key header. Whether it's required depends on how your instance is configured by OSPRI.

cURL

curl "https://api.previq.ospri.bio/api/v1/prevalence/summary" \
  -H "X-API-Key: YOUR_API_KEY"

Python

import httpx

headers = {"X-API-Key": "YOUR_API_KEY"}
r = httpx.get("https://api.previq.ospri.bio/api/v1/prevalence/summary", headers=headers)

Note

In development the key is typically off, so requests work without a header. In production, OSPRI will tell you whether a key is required and provide one. Treat any key as a secret — don't commit it to source control or expose it in client-side code.

CORS (browser access)

If you call the API from a browser app, the request origin must be allow-listed. PrevIQ permits:

http://localhost:3000 and http://127.0.0.1:3000 for local development, and
additional origins configured by OSPRI (for example your deployed front-end domain).

Allowed methods are GET, POST, and OPTIONS. The Content-Disposition header is exposed so browser downloads receive the correct filename.

Tip

Server-to-server calls (cURL, Python, backend services) are not subject to CORS — it only applies to browsers. If a browser request is blocked, ask OSPRI to add your origin to the allow-list.