> ## Documentation Index
> Fetch the complete documentation index at: https://docs.getcurrent.ca/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> How to authenticate API requests

All API requests require an API key. You can generate one from your [API Keys](https://app.getcurrent.ca/api-keys) page.

Keys follow the format `cur_live_xxxxxxxxxxxx`.

## Authentication methods

There are two ways to authenticate. Both are equivalent — use whichever fits your HTTP client.

### Bearer token (recommended)

Pass your key in the `Authorization` header:

```bash theme={null}
Authorization: Bearer cur_live_xxxxxxxxxxxx
```

### API key header

Alternatively, use the `X-API-Key` header:

```bash theme={null}
X-API-Key: cur_live_xxxxxxxxxxxx
```

## Full example

<CodeGroup>
  ```bash Bearer token theme={null}
  curl -X POST https://api.getcurrent.ca/v1/search \
    -H "Authorization: Bearer cur_live_xxxxxxxxxxxx" \
    -H "Content-Type: application/json" \
    -d '{"name": "Acme Corp"}'
  ```

  ```bash X-API-Key header theme={null}
  curl -X POST https://api.getcurrent.ca/v1/search \
    -H "X-API-Key: cur_live_xxxxxxxxxxxx" \
    -H "Content-Type: application/json" \
    -d '{"name": "Acme Corp"}'
  ```
</CodeGroup>

## Security best practices

<Warning>
  Never expose your API key in client-side code, public repositories, or logs.
</Warning>

* Store keys in environment variables, not hardcoded in source files
* Use secrets managers (AWS Secrets Manager, HashiCorp Vault, Vercel env vars) in production
* Rotate keys immediately if you suspect compromise — generate a new key on the [API Keys](https://app.getcurrent.ca/api-keys) page

## Error responses

| Status             | Meaning                             |
| ------------------ | ----------------------------------- |
| `401 Unauthorized` | Key is missing, invalid, or revoked |

```json theme={null}
{ "error": "Invalid API key" }
```