# Authenticate requests

> How API keys work, where to send them, and how to keep them safe.

Every request is authenticated with an API key sent in the `X-API-KEY` header.

```bash
curl https://api.correctinbox.com/v1/accounts \
  -H "X-API-KEY: $CORRECTINBOX_API_KEY"
```

```js
fetch("https://api.correctinbox.com/v1/accounts", {
  headers: { "X-API-KEY": process.env.CORRECTINBOX_API_KEY },
});
```

```python
requests.get(
    "https://api.correctinbox.com/v1/accounts",
    headers={"X-API-KEY": os.environ["CORRECTINBOX_API_KEY"]},
)
```

## Creating keys

Create and revoke keys in the [dashboard](https://app.correctinbox.com) under **Settings → API keys**. A key is shown in full only once, at creation. Store it somewhere safe immediately.

Keys are prefixed so you can tell them apart at a glance:

| Prefix | Environment |
| --- | --- |
| `sk_live_` | Live — acts on real connected accounts |
| `sk_test_` | Test — safe sandbox, no real provider activity |

## Keep keys on the server

An API key can act on every account in your workspace, so **never ship it to a browser, mobile app, or public repository**. Call CorrectInbox from your backend and expose only the results your own app needs.

## Errors

| Status | `type` | Meaning |
| --- | --- | --- |
| `401` | `invalid_api_key` | The key is missing, malformed, or revoked. |
| `403` | `insufficient_scope` | The key is valid but not allowed to perform this action. |

A missing or bad key always returns `401`:

```json
{
  "object": "error",
  "type": "invalid_api_key",
  "status": 401,
  "detail": "No API key was provided in the X-API-KEY header.",
  "request_id": "req_a1b2c3"
}
```