# Authentication

Where your API key lives, how to send it, and how to keep it safe.

> Enterprise API · https://developer.telgea.com/docs/enterprise/concepts/authentication

Every request to the Telgea API carries your organisation's API key in the `x-api-key` header. There are no user logins, sessions or OAuth flows on the API.

## Where the key is [#where-the-key-is]

Your key is managed in your Telgea Portal under **Integrations → API keys**, at `https://<your-organisation>.telgea.com/integrations/api-keys` (for example [telgea.telgea.com/integrations/api-keys](https://telgea.telgea.com/integrations/api-keys)). Admins create keys there, and a new key is shown once at creation.

## Sending it [#sending-it]

```bash
curl https://api.telgea.com/v1/users \
  -H "x-api-key: $TELGEA_API_KEY"
```

A missing or invalid key returns `401`. A valid key without the permission an operation needs returns `403`, naming the missing permission; every operation in the [API reference](https://developer.telgea.com/docs/enterprise/api) lists the permission it needs.

To check a key before writing any code, paste it into the [playground](https://developer.telgea.com/playground) and send a read such as **List users**.

## Keeping it safe [#keeping-it-safe]

* Store the key in a secret manager and read it into your server at runtime.
* Never ship it in a browser, a mobile app, or a repository.
* Use one key per integration so you can retire one without touching the others.

## Related [#related]

* [Users](https://developer.telgea.com/docs/enterprise/api/users): the first call most integrations make.