> ## Documentation Index
> Fetch the complete documentation index at: https://docs.infinipost.co/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Learn how to authenticate your API requests

## API Keys

The Infinipost API uses API keys to authenticate requests. You can generate and manage your API keys from the [Infinipost dashboard](https://infinipost.co/settings/api).

## Obtaining Your API Key

1. Navigate to **Settings** → **API Keys** in your dashboard
2. Click **Generate New API Key**
3. Give your key a descriptive name (e.g., "Production Server")
4. Copy the key immediately (it won't be shown again)

<Warning>
  **Keep your API keys secure!** Treat them like passwords:

  * Don't commit them to version control
  * Don't share them publicly
  * Rotate them regularly
  * Use environment variables in your code
</Warning>

## Using Your API Key

Include your API key in the `Authorization` header of every request:

```bash theme={null}
Authorization: Bearer YOUR_API_KEY
```

### Example Request

<CodeGroup>
  ```bash cURL theme={null}
  curl https://api.infinipost.co/v1/accounts \
    -H "Authorization: Bearer sk_live_abc123..."
  ```

  ```javascript JavaScript theme={null}
  const response = await fetch('https://api.infinipost.co/v1/accounts', {
    headers: {
      'Authorization': 'Bearer sk_live_abc123...'
    }
  });
  ```

  ```python Python theme={null}
  import requests

  response = requests.get(
      'https://api.infinipost.co/v1/accounts',
      headers={'Authorization': 'Bearer sk_live_abc123...'}
  )
  ```
</CodeGroup>

## API Key Types

Infinipost provides two types of API keys:

<CardGroup cols={2}>
  <Card title="Test Keys" icon="flask">
    Start with `sk_test_`

    * Use for development and testing
    * No charges incurred
    * Limited to 10 accounts
  </Card>

  <Card title="Live Keys" icon="bolt">
    Start with `sk_live_`

    * Use for production
    * Full access to all features
    * Standard billing applies
  </Card>
</CardGroup>

## Best Practices

### Store Keys Securely

Use environment variables instead of hardcoding:

```javascript theme={null}
// ✅ Good
const apiKey = process.env.INFINIPOST_API_KEY;

// ❌ Bad
const apiKey = 'sk_live_abc123...';
```

### Rotate Keys Regularly

1. Generate a new key in the dashboard
2. Update your application to use the new key
3. Delete the old key once confirmed working

### Use Separate Keys per Environment

Create different keys for different environments:

* `Production API Key` → Production server
* `Staging API Key` → Staging server
* `Development API Key` → Local development

## Error Responses

### Missing API Key

```json theme={null}
{
  "error": {
    "code": "unauthorized",
    "message": "No API key provided"
  }
}
```

**HTTP Status:** `401 Unauthorized`

### Invalid API Key

```json theme={null}
{
  "error": {
    "code": "invalid_api_key",
    "message": "The API key provided is invalid"
  }
}
```

**HTTP Status:** `401 Unauthorized`

### Expired API Key

```json theme={null}
{
  "error": {
    "code": "api_key_expired",
    "message": "This API key has expired"
  }
}
```

**HTTP Status:** `401 Unauthorized`

## Questions?

If you're having authentication issues, reach out to [drew.arlint@gmail.com](mailto:drew.arlint@gmail.com).