> For the complete documentation index, see [llms.txt](https://docs.voveid.com/docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.voveid.com/docs/api-fundamentals/authorization.md).

# Authorization

Authenticate VOVE ID API requests with a private API key.

VOVE ID server APIs use a private API key in the `x-api-key` request header.

## Authentication header

```http
GET https://api.voveid.net/v2/users/customer-7f3d
x-api-key: vove_sandbox_replace_me
accept: application/json
```

| Header         | Required        | Description                                  |
| -------------- | --------------- | -------------------------------------------- |
| `x-api-key`    | Yes             | Private API key for the selected environment |
| `content-type` | For JSON bodies | Use `application/json`                       |
| `accept`       | Recommended     | Use `application/json`                       |

The key determines the organization and environment available to the request. A Sandbox key cannot access Production resources.

## Server-side example

```javascript
const response = await fetch('https://api.voveid.net/v2/users/customer-7f3d', {
  headers: {
    accept: 'application/json',
    'x-api-key': process.env.VOVE_API_KEY,
  },
});

if (!response.ok) {
  throw new Error(`VOVE request failed (${response.status})`);
}
```

## Key handling

* Store API keys in a secret manager or protected server environment variable.
* Never put a private API key in browser JavaScript, a mobile application, a public repository, a URL, or a screenshot.
* Never log the key or include it in analytics, crash reports, or support attachments.
* Use separate credentials for Sandbox and Production.
* Rotate the key immediately when exposure is suspected.

Client SDKs do not use this private key. They use a [public SDK key and session token](/docs/setup-your-credentials.md).

## Authentication errors

| Status | Meaning                           | Action                                                       |
| ------ | --------------------------------- | ------------------------------------------------------------ |
| `401`  | The API key is missing or invalid | Check secret injection and environment; do not retry blindly |