> ## Documentation Index
> Fetch the complete documentation index at: https://new.cove.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> API key format, environments, and authentication errors

## API Key Format

All requests require an `x-api-key` header with a valid API key.

```
sk_{env}_{32_character_random_token_here}
│  │      └─ 32-character random token
│  └──────── environment: live or test
└──────────── prefix: sk (secret key)
```

## Using your API key

Include the key in every request:

```bash theme={null}
curl https://vvdufluovypptsnkihyv.supabase.co/functions/v1/consumers \
  -H "x-api-key: sk_test_your_api_key_here"
```

## Sandbox vs Production

| Key prefix | Mode       | Behavior                                                                                                                          |
| ---------- | ---------- | --------------------------------------------------------------------------------------------------------------------------------- |
| `sk_test_` | Sandbox    | Data is created normally. Metro 2 files are generated but **never uploaded** to bureaus. Simulated bureau responses are returned. |
| `sk_live_` | Production | Full pipeline: data → Metro 2 → SFTP upload → bureau processing → webhook notifications.                                          |

<Info>Use sandbox keys during development and integration testing. Webhooks fire normally in both modes.</Info>

## Authentication Errors

| Scenario                       | Error Code             | HTTP Status |
| ------------------------------ | ---------------------- | ----------- |
| Missing `x-api-key` header     | `AUTHENTICATION_ERROR` | 401         |
| Invalid key format             | `AUTHENTICATION_ERROR` | 401         |
| Key not found or hash mismatch | `AUTHENTICATION_ERROR` | 401         |
| Partner account suspended      | `AUTHORIZATION_ERROR`  | 403         |
| Key environment mismatch       | `AUTHENTICATION_ERROR` | 401         |

```json Example error response theme={null}
{
  "error": {
    "code": "AUTHENTICATION_ERROR",
    "message": "Missing x-api-key header",
    "request_id": "4e9024e3-125d-4d08-a392-4fa34f6bda44"
  }
}
```