> ## Documentation Index
> Fetch the complete documentation index at: https://docs.wappfy.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> How to authenticate with the Wappfy API using API keys or JWT tokens.

# Authentication

The Wappfy API supports two authentication methods. All requests must include one of these.

## API Key (recommended)

Pass your API key in the `X-Api-Key` header:

```bash theme={null}
curl https://api.wappfy.io/api/instances \
  -H "X-Api-Key: wappfy_sk_abc123def456..."
```

### Creating an API key

API keys are created via the dashboard or the API. Keys are scoped to a user and have the same permissions as the user's account.

```bash theme={null}
curl -X POST https://api.wappfy.io/api/api-keys \
  -H "Authorization: Bearer YOUR_SUPABASE_JWT" \
  -H "Content-Type: application/json" \
  -d '{ "name": "Production Key" }'
```

<Warning>
  The key value is only returned once at creation time. Store it securely.
</Warning>

## Bearer Token (Supabase JWT)

Pass a Supabase access token in the `Authorization` header:

```bash theme={null}
curl https://api.wappfy.io/api/instances \
  -H "Authorization: Bearer eyJhbGciOiJIUzI1NiIs..."
```

JWT tokens are short-lived and must be refreshed. They are typically used by the frontend dashboard, not for server-to-server integrations.

## Security best practices

<AccordionGroup>
  <Accordion title="Use API keys for server-to-server">
    API keys don't expire and are easier to manage for backend integrations.
  </Accordion>

  <Accordion title="Rotate keys regularly">
    If a key is compromised, delete it and create a new one.
  </Accordion>

  <Accordion title="Use HTTPS always">
    All API requests must use HTTPS. HTTP requests will be rejected.
  </Accordion>

  <Accordion title="Don't expose keys in frontend code">
    API keys should only be used in server-side code, never in client-side JavaScript.
  </Accordion>
</AccordionGroup>

## Error responses

| Status | Description                                |
| ------ | ------------------------------------------ |
| `401`  | Missing or invalid authentication token    |
| `403`  | Insufficient permissions for this resource |