> ## Documentation Index
> Fetch the complete documentation index at: https://docs.squadassist.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication — API Keys

> How to authenticate with the SquadAssist API using API keys for server-to-server integrations.

### Obtaining your API key

API keys authenticate requests to the endpoints. They are static credentials tied to a user account.

Contact SquadAssist to obtain an API key for your account.

### Sending your API key

You can pass the API key in either of two ways. Both are accepted on every endpoint.

<CodeGroup>
  ```bash x-api-key header theme={null}
  curl https://api.squadassist.ai/v1/player_positions \
    -H "x-api-key: <your-api-key>"
  ```

  ```bash Authorization Bearer header theme={null}
  curl https://api.squadassist.ai/api/player_positions \
    -H "Authorization: Bearer <your-api-key>"
  ```
</CodeGroup>

<Tip>
  The `x-api-key` header is the recommended style for server-to-server requests as it avoids ambiguity with JWT Bearer tokens.
</Tip>

<Warning>
  API keys are sensitive credentials. Never expose them in client-side code, commit them to version control, or log them. Store them in environment variables or a secrets manager.
</Warning>

***

## Authentication errors

Both authentication methods return the same HTTP status codes when credentials are missing or invalid.

| Status | Body                                           | Cause                                                                                                |
| ------ | ---------------------------------------------- | ---------------------------------------------------------------------------------------------------- |
| `401`  | `{"error": "Missing API key"}`                 | No API key was sent in the request                                                                   |
| `401`  | `{"error": "Invalid API key"}`                 | The API key is not recognised or has an invalid format                                               |
| `401`  | `{"error": "API key is revoked"}`              | The key has been revoked and can no longer be used                                                   |
| `401`  | `{"error": "Invalid email or password"}`       | Credentials supplied to `/auth/login` are incorrect                                                  |
| `403`  | `{"error": "Account access denied: <reason>"}` | Your account exists but is inactive, not yet activated, or does not have access on your current plan |

If you receive a `403` with an account access denied message, contact SquadAssist to review your account status or plan.