> ## Documentation Index
> Fetch the complete documentation index at: https://docs.stealthera.in/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> How to authenticate requests to the Stealthera API

## API keys

Every request to the Stealthera API must include a valid API key. Keys are issued per client and are scoped to the devices assigned to your organization.

To obtain a key, contact [support@stealthera.in](mailto:support@stealthera.in) with your organization details. You will receive:

* Your **base URL** — `https://api.stealthera.in`
* An **API key**

## Sending the key

Pass the key in the `X-API-Key` request header on every call.

<CodeGroup>
  ```bash cURL theme={null}
  curl https://api.stealthera.in/api/health-data \
    -H "X-API-Key: YOUR_API_KEY"
  ```

  ```python Python theme={null}
  import requests

  resp = requests.get(
      "https://api.stealthera.in/api/health-data",
      headers={"X-API-Key": "YOUR_API_KEY"},
  )
  print(resp.json())
  ```

  ```javascript JavaScript theme={null}
  const resp = await fetch("https://api.stealthera.in/api/health-data", {
    headers: { "X-API-Key": "YOUR_API_KEY" },
  });
  const data = await resp.json();
  console.log(data);
  ```
</CodeGroup>

<Warning>
  A request without a valid `X-API-Key` returns `401 Unauthorized`. Keep your key on the server side and never embed it in browser or mobile client code.
</Warning>

## Good practice

* Store the key in a secret manager or environment variable, not in source control.
* Use a separate key per environment (staging, production).
* Request a key rotation through support if a key may have been exposed.