> For the complete documentation index, see [llms.txt](https://docs.veilio.xyz/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.veilio.xyz/documentation/getting-started/quickstart.md).

# Quickstart

This quickstart gives you a first end-to-end Veilio flow.

<figure><img src="https://871091000-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F0WqIAiGHfaanrggvU6xD%2Fuploads%2Fe4BScrVBANmNHxON00Ot%2Fimage%20(2).png?alt=media&amp;token=0562d36a-cada-459c-8325-414bbb40a6ba" alt=""><figcaption></figcaption></figure>

#### Prerequisites

* A Veilio account and API key from **Dashboard → API Keys**
* A backend environment (never call Veilio with secrets from frontend or mobile code)
* `curl` installed (or use the JavaScript / Python SDK)

#### 1) Create an API key

1. Sign in at [app.veilio.fr](https://app.veilio.fr/).
2. Open **Dashboard → API Keys**.
3. Click **Create API key**, choose **Standard** purpose for day-to-day operations.
4. Copy the key once — it is shown only at creation time.

#### 2) Set environment variables

```bash
export VEILIO_API_KEY="veil_live_xxxxxxxx"
export VEILIO_BASE_URL="https://app.veilio.fr/api"
```

For **on-premise** deployments, set `VEILIO_BASE_URL` to your instance URL, e.g. `https://veilio.your-company.com/api`.

#### 3) Tokenize a sensitive value

```bash
curl -s -X POST "$VEILIO_BASE_URL/tokenize" \
  -H "Authorization: Bearer $VEILIO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"data":"support@veilio.fr","type":"email"}'
```

Expected response:

```json
{
  "token": "tok_abc123...",
  "createdAt": "2026-03-26T10:00:00.000Z"
}
```

**Store only `token` in your database** — never the raw email.

#### 4) Detokenize when required

```bash
curl -s -X POST "$VEILIO_BASE_URL/detokenize" \
  -H "Authorization: Bearer $VEILIO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"token":"tok_abc123...","reason":"Send user notification"}'
```

Expected response:

```json
{
  "data": "support@veilio.fr",
  "accessedAt": "2026-03-26T10:01:00.000Z"
}
```

The `reason` field is logged for audit and compliance.

#### 5) Recommended application pattern

| Path                                     | Pattern                                                  |
| ---------------------------------------- | -------------------------------------------------------- |
| **Write** (create / update user)         | Tokenize before insert or update                         |
| **Read** (display profile)               | Store and display the token, or a masked placeholder     |
| **Action** (send email, export, support) | Detokenize only at the business step that needs raw data |
| **Audit**                                | Always pass a clear `reason` on detokenization           |

{% hint style="warning" %}
**Do not** detokenize automatically on every page load to show raw PII in the browser. That exposes sensitive data in your frontend, logs, and network traces. Detokenize on the **server**, only when a specific workflow requires it (email send, PDF export, support ticket, etc.).
{% endhint %}

#### Next steps

| Goal                          | Page                                        |
| ----------------------------- | ------------------------------------------- |
| SDK integration (recommended) | SDK Javascript · SDK Python                 |
| Direct HTTP / all endpoints   | HTTP Integration · API Reference            |
| Production checklist          | Security Best Practices · Go-live Checklist |
| Historical import             | Historical Migration Mode                   |

**Related links**

* Product website: [https://veilio.fr](https://veilio.fr/)
* Contact : <https://veilio.fr/contact>