# Authentication

Every authenticated Public v1 request needs one active Customer API Key. Send it
as an HTTP bearer credential:

```bash
curl "https://api.envoapi.com/v1/profiles/details/by-username?username=<PROFILE_USERNAME>" \
  --header "Authorization: Bearer $ENVO_API_KEY" \
  --header "Accept: application/json"
```

Send exactly one `Authorization: Bearer <ENVO_API_KEY>` header. Other authentication
headers are not supported. Do not put an API Key in a URL, query string, request
body, or cookie.

## Call EnvoAPI from your server

An API Key grants access on behalf of its Customer Account. Keep it in a
server-side environment variable or secrets manager; never ship it in browser
or mobile application code.

```ts
export async function getProfile(username: string) {
  const url = new URL("https://api.envoapi.com/v1/profiles/details/by-username");
  url.searchParams.set("username", username);

  const response = await fetch(url, {
    headers: {
      accept: "application/json",
      authorization: `Bearer ${process.env.ENVO_API_KEY ?? ""}`,
    },
  });

  return response.json();
}
```

The same pattern in Python:

```python
import os

import requests


def get_profile(username: str):
    response = requests.get(
        "https://api.envoapi.com/v1/profiles/details/by-username",
        params={"username": username},
        headers={
            "Accept": "application/json",
            "Authorization": f"Bearer {os.environ['ENVO_API_KEY']}",
        },
        timeout=30,
    )
    return response.json()
```

## Diagnose a 401

A missing, malformed, unknown, or inactive API Key returns `401` with the
standard [error envelope](https://docs.envoapi.com/guides/errors.md):

```json
{
  "error": {
    "code": "invalid_api_key",
    "message": "The API Key is invalid.",
    "retryable": false,
    "details": []
  },
  "meta": {
    "requestId": "request-example"
  }
}
```

When a request unexpectedly returns `401`, check that:

* the `Authorization` value begins with `Bearer ` and contains the key after
  the space;
* the environment variable is present and has no surrounding whitespace or
  trailing line break; and
* every HTTP client used by the application adds the credential header.

Log whether a credential was present, never its value. If a key leaks, revoke
or rotate it immediately and update the server environment. All API Keys on a
Customer Account share that Account's access and [rate limit](https://docs.envoapi.com/guides/rate-limits.md).

[Documentation index](https://docs.envoapi.com/llms.txt) · [All endpoints](https://docs.envoapi.com/api/index.md)