> ## Documentation Index
> Fetch the complete documentation index at: https://developer.sodacards.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Authenticate every request with a scoped API key.

The API authenticates with a key you pass on every request. Keys are issued from
your reseller dashboard and shown in full only once, at creation.

## Passing the key

Send the key in the `X-API-Key` header:

```bash theme={null}
curl https://api.sodacards.com/v1/catalog \
  -H "X-API-Key: sc_live_your_key_here"
```

A `Bearer` token is also accepted:

```bash theme={null}
curl https://api.sodacards.com/v1/catalog \
  -H "Authorization: Bearer sc_live_your_key_here"
```

## Key format

Keys are prefixed by environment: `sc_live_` for production, `sc_test_` for the
sandbox. The prefix and the last four characters are shown in your dashboard so you
can recognise a key without it being re-displayed.

<Warning>
  Treat a key like a password. It is shown once. If it leaks, revoke it from the
  dashboard and issue a new one — revocation is immediate.
</Warning>

## Scopes

A key carries scopes that bound what it can do: `catalog:read`, `orders:read`,
`orders:write`, `wallet:read`, `webhooks:manage`. Issue a narrow key for a narrow
job; a request beyond a key's scopes is refused with `403 forbidden`.

## IP allowlisting

A key can be locked to a set of IP addresses or CIDR ranges. A request from any
other address is refused. Leave the allowlist empty to accept any address. Our
outbound webhook deliveries come from a fixed IP, which we publish so you can
allowlist us in turn.