> ## Documentation Index
> Fetch the complete documentation index at: https://docs.usebila.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Learn how to authenticate with the Bila API

The Bila API authenticates requests via API keys. Manage your keys in the [Bila Console](https://app.usebila.com).

## Key Types

| Key Type        | Prefix     | Environment | Description                     |
| --------------- | ---------- | ----------- | ------------------------------- |
| Live Secret Key | `sk_live_` | Production  | Use for live transactions       |
| Test Secret Key | `sk_test_` | Sandbox     | Use for testing and development |

<Warning>
  Never share API keys in client-side code, public repositories, or anywhere accessible without authentication.
</Warning>

## Making Authenticated Requests

Include your API key in the `x-api-key` header with every request:

<CodeGroup>
  ```bash cURL theme={null}
  curl -X GET "https://api.usebila.com/api/v1/bila/accounts" \
    -H "x-api-key: sk_live_your_api_key_here" \
    -H "Content-Type: application/json"
  ```

  ```javascript Node.js theme={null}
  const response = await fetch('https://api.usebila.com/api/v1/bila/accounts', {
    method: 'GET',
    headers: {
      'x-api-key': 'sk_live_your_api_key_here',
      'Content-Type': 'application/json'
    }
  });

  const data = await response.json();
  ```

  ```python Python theme={null}
  import requests

  response = requests.get(
      'https://api.usebila.com/api/v1/bila/accounts',
      headers={
          'x-api-key': 'sk_live_your_api_key_here',
          'Content-Type': 'application/json'
      }
  )

  data = response.json()
  ```

  ```php PHP theme={null}
  $curl = curl_init();

  curl_setopt_array($curl, [
      CURLOPT_URL => 'https://api.usebila.com/api/v1/bila/accounts',
      CURLOPT_RETURNTRANSFER => true,
      CURLOPT_HTTPHEADER => [
          'x-api-key: sk_live_your_api_key_here',
          'Content-Type: application/json'
      ]
  ]);

  $response = curl_exec($curl);
  $data = json_decode($response, true);
  ```
</CodeGroup>

## Authentication Errors

Failed authentication returns a `401` response:

```json theme={null}
{
  "status": false,
  "message": "Unauthorized - Invalid or missing API key"
}
```

### Common Authentication Issues

| Error             | Cause                             | Solution                        |
| ----------------- | --------------------------------- | ------------------------------- |
| Missing API key   | No `x-api-key` header             | Add the header to your request  |
| Invalid API key   | Key doesn't exist or is malformed | Check your key in the dashboard |
| Expired API key   | Key has been revoked              | Generate a new key              |
| Wrong environment | Using test key in production      | Use the correct key type        |

## Best Practices

<AccordionGroup>
  <Accordion title="Store keys securely">
    Use environment variables or a secrets manager to store your API keys. Never hardcode them in your source code.
  </Accordion>

  <Accordion title="Use different keys for different environments">
    Use test keys (`sk_test_`) for development and live keys (`sk_live_`) for production.
  </Accordion>

  <Accordion title="Rotate keys periodically">
    Regularly rotate your API keys as a security best practice.
  </Accordion>

  <Accordion title="Restrict key permissions">
    If available, create keys with only the permissions your application needs.
  </Accordion>
</AccordionGroup>