> ## Documentation Index
> Fetch the complete documentation index at: https://docs.getplu.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> API key authentication for the Card Partners API

All API requests must include your API key. There are two ways to pass it:

## Bearer Token (Recommended)

```bash theme={null}
Authorization: Bearer sk_staging_your_api_key_here
```

## API Key Header

```bash theme={null}
x-api-key: sk_staging_your_api_key_here
```

## API Key Format

| Environment | Prefix        | Example                      |
| ----------- | ------------- | ---------------------------- |
| Staging     | `sk_staging_` | `sk_staging_abc123def456...` |
| Production  | `sk_live_`    | `sk_live_abc123def456...`    |

## How It Works

1. The API extracts your key from the `Authorization` or `x-api-key` header
2. The first 16 characters are used to look up your partner account
3. The full key is verified against the stored hash using bcrypt
4. Validated keys are cached for 5 minutes to reduce latency on subsequent requests

## What Gets Attached

On successful authentication, the API attaches your partner context to the request. This includes your partner ID, fee configuration, and a data filter that scopes all queries to your account.

## Error Responses

```json 401 — Missing or invalid API key theme={null}
{
  "status": "error",
  "message": "Unauthorized",
  "data": {
    "error": "Invalid API key"
  }
}
```

```json 403 — Partner suspended theme={null}
{
  "status": "error",
  "message": "Forbidden",
  "data": {
    "error": "Partner account is suspended"
  }
}
```

<Warning>
  Keep your API key secret. Do not expose it in client-side code, public repositories, or logs. If compromised, contact support immediately to rotate it.
</Warning>