> ## Documentation Index
> Fetch the complete documentation index at: https://docs.settlx.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Authenticate API requests using your secret API key

# Authentication

The Settlx API uses **API key authentication**. Every request to a protected endpoint must include your secret API key in the `Authorization` header as a Bearer token.

```
Authorization: Bearer pk_live_...
```

API keys begin with `pk_live_`.

<Warning>
  Never expose your API key in client-side code, browser JavaScript, mobile apps, or public repositories. All authenticated API calls must be made server-side.
</Warning>

***

## Getting your API key

1. Log in to the [Settlx Dashboard](https://app.settlx.io)
2. Go to **Settings → API Keys**
3. Click **Create API Key**
4. Copy the key immediately — it is shown **only once** and cannot be retrieved again

Store the key in an environment variable. Do not commit it to source control.

```bash theme={null}
# .env
SETTLX_API_KEY=pk_live_...
```

***

## Example requests

<CodeGroup>
  ```bash cURL theme={null}
  curl https://api.settlx.io/api/v1/invoices \
    -H "Authorization: Bearer $SETTLX_API_KEY" \
    -H "Content-Type: application/json"
  ```

  ```javascript Node.js theme={null}
  const response = await fetch('https://api.settlx.io/api/v1/invoices', {
    headers: {
      'Authorization': `Bearer ${process.env.SETTLX_API_KEY}`,
      'Content-Type': 'application/json',
    },
  });
  ```

  ```python Python theme={null}
  import httpx, os

  client = httpx.Client(
    headers={
      "Authorization": f"Bearer {os.environ['SETTLX_API_KEY']}",
      "Content-Type": "application/json",
    }
  )
  response = client.get("https://api.settlx.io/api/v1/invoices")
  ```
</CodeGroup>

***

## Key management

| Action           | Where                                                              |
| ---------------- | ------------------------------------------------------------------ |
| Create a new key | Dashboard → Settings → API Keys                                    |
| Revoke a key     | Dashboard → Settings → API Keys → Revoke                           |
| Rotate a key     | Create a new key, update your environment, then revoke the old key |

Revoked keys are rejected immediately. There is no grace period.

<Note>
  If you suspect your API key has been compromised, revoke it immediately from the dashboard and generate a new one.
</Note>

***

## Public endpoints

The following endpoints do not require authentication and are safe to call from a browser or mobile client:

| Endpoint                          | Description                      |
| --------------------------------- | -------------------------------- |
| `GET /api/v1/chains`              | List supported chains            |
| `GET /api/v1/tokens`              | List supported tokens and chains |
| `GET /api/v1/invoices/:id/status` | Poll invoice payment status      |

***

## Authentication errors

| Status                  | Cause                                                         |
| ----------------------- | ------------------------------------------------------------- |
| `401 Unauthorized`      | Missing, malformed, or revoked API key                        |
| `403 Forbidden`         | Valid key but merchant account is inactive or suspended       |
| `429 Too Many Requests` | Rate limit exceeded — see [API Conventions](/api-conventions) |