> ## Documentation Index
> Fetch the complete documentation index at: https://docs.authmatech.com/llms.txt
> Use this file to discover all available pages before exploring further.

# API Authentication: X-API-KEY & X-CLIENT-ID

> Reference for authenticating Authmatech API requests: the X-API-KEY and X-CLIENT-ID headers, the SDK token scope, and the 401 error response.

Authmatech uses **API-key authentication**. The OpenAPI security scheme is `ApiKey`, an API key passed in the `X-API-KEY` header, accompanied on every operation by the `X-CLIENT-ID` header that identifies your account.

## Required headers

| Header         | Required   | Description                              |
| -------------- | ---------- | ---------------------------------------- |
| `X-API-KEY`    | Yes        | Your secret API key. Server-side only.   |
| `X-CLIENT-ID`  | Yes        | Your Client ID, identifying the account. |
| `Content-Type` | For bodies | `application/json`                       |

```bash theme={null}
curl -X POST https://service.authmatech.com/v1/api/verify \
  -H "X-API-KEY: YOUR_API_KEY" \
  -H "X-CLIENT-ID: YOUR_CLIENT_ID" \
  -H "Content-Type: application/json" \
  -d '{ "mobileNumber": "+962791234567", "encryptedMobileNumber": "…", "operatorId": "ZAIN_JO", "serviceType": "LOGIN" }'
```

## Credential scopes

| Credential | Header        | Allowed endpoints                  |
| ---------- | ------------- | ---------------------------------- |
| API key    | `X-API-KEY`   | All server APIs under `/v1/api/**` |
| SDK token  | `X-SDK-TOKEN` | Only `/v1/api/sdk/session`         |

<Warning>
  The SDK token cannot call Verify or any other server API — it exists so app code never holds your API key. The native [mobile SDKs](/sdks/mobile) use it to register a session; the browser [Web SDK](/sdks/web) is transaction-based and uses no credential in client code.
</Warning>

## Unauthorized response

A missing or invalid `X-API-KEY` / `X-CLIENT-ID` returns `401` in the standard envelope:

```json theme={null}
{
  "success": false,
  "messages": [
    { "type": "FAILURE", "message": "Unauthorized", "httpStatus": "UNAUTHORIZED" }
  ],
  "data": null
}
```

## Rotating keys

* `POST /v1/api/me/api-key/rotate` — rotate your own key (requires the client secret). See [Rotate an API key](/authentication).
* `POST /v1/api/me/api-key/generate` — generate your first key. See [Generate an API key](/authentication).

For security best practices, see the [Authentication guide](/authentication).