> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cashweb.cash/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> API key authentication and partner data scoping behavior.

All partner endpoints require API key authentication.

## Required Header

```http theme={null}
X-API-KEY: <partner_api_key>
```

## Security Guidance

* Keep keys server-side only.
* Never expose keys in browser/mobile clients.
* Rotate keys immediately after suspected compromise.
* Restrict outbound logs so API keys are never recorded.

## Partner Scope Guarantee

Every endpoint is server-side scoped to your partner identity. Your API key cannot read or mutate another partner's transactions, webhook telemetry, or revenue data.

## Unauthorized Responses

* `401 Unauthorized`: missing, malformed, or invalid API key.