---
title: Authentication
description: Every request is authenticated with an API key in the X-API-Key header.
sidebar:
  order: 2
---

Every request is authenticated with an API key in the `X-API-Key` header.

```bash
curl https://api.vault.stashtab.gg/v1/account \
  -H "X-API-Key: sk_live_..."
```

Keys are managed in the partner console, are named, may carry an expiry, and
can be deactivated at any time.

:::warning
Keys must only be used server-side. Never embed a Vault API key in a browser,
mobile app, or any other client an end user can inspect.
:::

Key prefixes are environment-bound: `sk_live_*` keys work only on production
and `sk_test_*` keys work only on sandbox — see
[Environments & sandbox](/environments) for the partitioning rules.