# Authentication

One key per partner, sent to you at signing; how to send it and what to do if it leaks.

> Partner API · https://developer.telgea.com/docs/partner/concepts/authentication

Every request to the Partner API carries your API key in the `x-api-key` header. The key is scoped to your organization: it reaches your own customers and nothing else. There are no user logins, sessions or OAuth flows on the API.

## How you get the key [#how-you-get-the-key]

Telgea creates your key when your contract is signed and sends it to you through a secure one-time link. Open the link once and put the key straight into your secret manager: the link stops working after that, and nobody at Telgea sees the key.

## Sending it [#sending-it]

```bash
curl https://api.telgea.com/v1/users \
  -H "x-api-key: $TELGEA_API_KEY"
```

A missing or invalid key returns `401`. A valid key without the permission an operation needs returns `403`, naming the missing permission; every operation in the [API reference](https://developer.telgea.com/docs/partner/api) lists the permission it needs.

To check the key before writing any code, paste it into the [playground](https://developer.telgea.com/playground) and send a read such as **List users**.

## If it leaks [#if-it-leaks]

Contact Telgea support. We disable the key and send you a new one the same way.

## Keeping it safe [#keeping-it-safe]

* Store the key in a secret manager and read it into your server at runtime.
* Never ship it in a browser, a mobile app, or a repository.
* The key identifies your organization to Telgea; your own customers must never see it.

## Related [#related]

* [Users](https://developer.telgea.com/docs/partner/api/users): the first call most integrations make.