> ## Documentation Index
> Fetch the complete documentation index at: https://docs.swipelux.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Authenticate Swipelux API requests with the X-API-Key header from a protected backend, use separate sandbox and live keys, and keep keys out of client code.

Keep every Swipelux API key on a protected backend. Never place a key in browser code, a mobile application bundle, or a client-visible configuration file.

## Send your API key

Use the shared base URL `https://platform.swipelux.com` and send your key in the `X-API-Key` header.

```bash theme={null}
export API_BASE='https://platform.swipelux.com'
export SWIPELUX_API_KEY='replace-with-your-api-key'

curl --request GET \
  "${API_BASE}/v3/capabilities" \
  --header "X-API-Key: ${SWIPELUX_API_KEY}"
```

[`GET /v3/capabilities`](/api-reference/capabilities/get-v3-capabilities) confirms that the key is valid and your backend can reach the API.

## Sandbox and production

Sandbox and production use the same API host. The API key selects the environment.

Keep the environment choice in deployment configuration. A production deployment must never fall back to a sandbox key, and a sandbox deployment must never receive production credentials.

## Store credentials safely

Store sandbox and production keys in separate secret-manager entries. Grant each backend deployment access only to the entry it needs.

Keep keys out of source control, logs, analytics, support screenshots, and error responses. Rotate a key if you believe it has been exposed.

If a request returns `unauthorized` or `forbidden`, use [Errors and retries](/integration/errors) to distinguish invalid credentials from missing permissions.

Next, [configure sandbox testing](/integration/sandbox) or start the [Quickstart](/integration/quickstart).


## Related topics

- [Errors and retries](/integration/errors.md)
- [Credit a sandbox account](/api-reference/sandbox/post-v3-sandbox-accounts-by-account-id-topup.md)
- [Upload customer document](/api-reference/documents/post-v3-customers-by-customer-id-documents.md)
- [Get account fees](/api-reference/accounts/get-v3-customers-by-customer-id-accounts-by-account-id-fees.md)
- [Archive webhook endpoint](/api-reference/webhooks/delete-v3-webhooks-by-webhook-id.md)