> ## Documentation Index
> Fetch the complete documentation index at: https://docs.streamlinedpayments.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Authenticate every request with your App ID and API key.

Every request needs two headers:

| Header | Value |
| - | - |
| `X-App-Id` | Your App ID. It identifies your Streamlined account. |
| `X-Api-Key` | Your API key. It's the secret that proves the request is yours. |

```bash theme={null}
curl https://api.staging.streamlinedpayments.com/api/v1/customers \
  -H "X-App-Id: $STREAMLINED_APP_ID" \
  -H "X-Api-Key: $STREAMLINED_API_KEY"
```

Sandbox and Production have separate credentials. Ask your Streamlined contact for both.

## Keep your API key secret

Your API key can read and change your customers, invoices and payment links, so treat it like a password.

* Call the API from your server, never from a browser or mobile app.
* Store keys in environment variables or a secrets manager, not in source control.
* Use Sandbox credentials everywhere except your production servers.

## When authentication fails

A missing or wrong header returns `401`:

```json theme={null}
{
  "error": "Authentication required",
  "message": "API endpoint requires authentication. Please provide valid X-App-Id and X-Api-Key headers."
}
```

Check that you're sending both headers, and that the credentials match the environment. Sandbox credentials don't work against Production, and Production credentials don't work against the Sandbox.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.