> ## Documentation Index
> Fetch the complete documentation index at: https://docs.mailerpath.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Authenticate MailerPath API requests with the correct header and API key handling practices.

Authenticate MailerPath API requests with an enabled API key.

The OpenAPI spec defines `ApiKeyAuth` on the `Authorization` header.

## Authentication header

Send your key in the `Authorization` header:

```http theme={null}
Authorization: Bearer YOUR_API_KEY
```

The OpenAPI spec also notes that the header accepts a raw API key. Use the `Bearer` format unless your integration already relies on the raw header value.

## API key format

MailerPath API keys use the `mp-sk-` prefix followed by a long random string.

Example format:

```text theme={null}
mp-sk-64-CHARACTER-RANDOM-STRING
```

## Example request

```bash theme={null}
curl https://api.mailerpath.com/api/v1/client/events \
  -X POST \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "event_type": "signup",
    "email": "person@example.com"
  }'
```

## Get an API key

1. Open **Settings**.
2. Go to **API keys**.
3. Create a key with a clear label.
4. Enable the key for the integration that will call the API.

For setup details, see [API keys](/documentation/settings/api-keys).

## Security practices

* Keep API keys in a secrets manager.
* Never expose API keys in browser code.
* Use separate keys for staging and production.
* Rotate keys when access changes.
* Revoke keys that are no longer needed.

## Common auth failures

* `401 Unauthorized`: the header is missing, malformed, or uses a disabled key.
* `403 Forbidden`: the key is valid but the request is not allowed for that integration.

If requests fail, confirm the header format and key status in [Common API issues](/documentation/troubleshooting/common-api-issues).