> ## Documentation Index
> Fetch the complete documentation index at: https://docs.mycashq.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Learn how to authenticate your API requests with CashQ

## API Key Authentication

All CashQ API requests require authentication using an API Key. Your API key identifies your merchant account and authorizes access to the CashQ platform.

## How to Authenticate

Include your API key in the request header of every API call:

```http theme={null}
API-KEY: your_api_key_here
```

### Example Request

```bash theme={null}
curl -X GET 'https://api.cashqbot.com/api/agent_balance' \
  -H 'API-KEY: your_api_key_here'
```

## Getting Your API Credentials

### Sandbox Credentials

To get credentials for the Sandbox environment:

1. Fill out the [Sandbox Request Form](https://cashqkyc.typeform.com/to/ysRjOpwP)
2. You'll receive your API key via email within 24 hours
3. Use the sandbox base URL: `https://api.cashqbot.com/`

### Production Credentials

When you're ready to go live:

1. Contact our support team at [support@mycashq.com](mailto:support@mycashq.com)
2. We'll provide your production environment credentials
3. You'll receive a separate API key for production use

<Warning>
  **Keep Your API Keys Secure**

  * Never share your API keys publicly
  * Don't commit API keys to version control
  * Use environment variables to store API keys
  * Rotate your keys periodically
  * Use different keys for sandbox and production
</Warning>

## Separate Credentials Per Environment

You will have separate API credentials for each environment:

| Environment | Purpose                 | How to Get                                                    |
| ----------- | ----------------------- | ------------------------------------------------------------- |
| Sandbox     | Testing and development | [Request via form](https://cashqkyc.typeform.com/to/ysRjOpwP) |
| Production  | Live transactions       | Contact support                                               |

<Info>
  Data created or modified in each environment will not affect the other, and data cannot be transferred between environments.
</Info>

## Authentication Errors

If your API key is missing or invalid, you'll receive an error response:

```json theme={null}
{
  "error": {
    "message": "Invalid or missing API key",
    "code": "authentication_error"
  },
  "success": "false"
}
```

### Common Authentication Issues

<AccordionGroup>
  <Accordion title="Missing API-KEY header">
    **Problem:** Request doesn't include the `API-KEY` header.

    **Solution:** Ensure you're including the header in every request:

    ```http theme={null}
    API-KEY: your_api_key_here
    ```
  </Accordion>

  <Accordion title="Invalid API key">
    **Problem:** The API key is incorrect or has been revoked.

    **Solution:**

    * Verify you're using the correct API key
    * Check if you're using the right key for the environment (sandbox vs production)
    * Contact support if you believe your key should be valid
  </Accordion>

  <Accordion title="Wrong environment">
    **Problem:** Using a sandbox key with production URL or vice versa.

    **Solution:** Ensure your API key matches the environment:

    * Sandbox key → `https://api.cashqbot.com/`
    * Production key → Production URL (provided by support)
  </Accordion>
</AccordionGroup>

## Best Practices

<CardGroup cols={2}>
  <Card title="Use Environment Variables" icon="gear">
    Store API keys in environment variables, not in your code:

    ```bash theme={null}
    export CASHQ_API_KEY="your_api_key_here"
    ```
  </Card>

  <Card title="Separate Keys" icon="key">
    Always use different API keys for sandbox and production environments.
  </Card>

  <Card title="Secure Storage" icon="lock">
    Never commit API keys to version control or share them publicly.
  </Card>

  <Card title="Regular Rotation" icon="rotate">
    Rotate your API keys periodically for enhanced security.
  </Card>
</CardGroup>

## Next Steps

<Card title="Make Your First Request" icon="rocket" href="/quickstart">
  Follow our quickstart guide to make your first authenticated API request.
</Card>