> ## Documentation Index
> Fetch the complete documentation index at: https://chariow.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Learn how to authenticate your API requests to Chariow

The Chariow API uses API keys to authenticate requests.

## Creating an API Key

<Steps>
  <Step title="Log in to Dashboard">
    Go to [app.chariow.com](https://app.chariow.com) and log in to your account.
  </Step>

  <Step title="Navigate to Settings">
    Click on **Settings** in the sidebar.
  </Step>

  <Step title="Open API Keys">
    Select **API Keys** from the settings menu.
  </Step>

  <Step title="Create New Key">
    Click **Create API Key**, give it a descriptive name, and copy the generated key.
  </Step>
</Steps>

<Warning>
  Copy your API key immediately after creation. For security reasons, the full key is only shown once.
</Warning>

## Making Authenticated Requests

Include your API key in the `Authorization` header of every request:

```bash theme={null}
Authorization: Bearer YOUR_API_KEY
```

### Example Request

<CodeGroup>
  ```bash cURL theme={null}
  curl -X GET "https://api.chariow.com/v1/store" \
    -H "Authorization: Bearer YOUR_API_KEY"
  ```

  ```javascript JavaScript theme={null}
  const response = await fetch('https://api.chariow.com/v1/store', {
    headers: {
      'Authorization': 'Bearer YOUR_API_KEY'
    }
  });
  ```

  ```python Python theme={null}
  import requests

  headers = {
      'Authorization': 'Bearer YOUR_API_KEY'
  }

  response = requests.get('https://api.chariow.com/v1/store', headers=headers)
  ```

  ```php PHP theme={null}
  $ch = curl_init();
  curl_setopt($ch, CURLOPT_URL, 'https://api.chariow.com/v1/store');
  curl_setopt($ch, CURLOPT_HTTPHEADER, [
      'Authorization: Bearer YOUR_API_KEY'
  ]);
  ```
</CodeGroup>

## Key Security Best Practices

<AccordionGroup>
  <Accordion title="Use Environment Variables" icon="shield-check">
    Store API keys in environment variables, not in your codebase:

    ```bash theme={null}
    # .env file
    CHARIOW_API_KEY=your_api_key

    # Access in your code
    process.env.CHARIOW_API_KEY
    ```
  </Accordion>

  <Accordion title="Use Different Keys for Environments" icon="code-branch">
    Create separate API keys for development, staging, and production environments. This limits the impact if a key is compromised.
  </Accordion>

  <Accordion title="Rotate Keys Regularly" icon="arrows-rotate">
    Periodically create new keys and deprecate old ones. This limits the window of opportunity for compromised keys.
  </Accordion>

  <Accordion title="Monitor Key Usage" icon="chart-line">
    Regularly review your API key usage in the dashboard. Look for unusual patterns that might indicate unauthorised access.
  </Accordion>

  <Accordion title="Restrict Server-Side Only" icon="server">
    Never expose your API key in client-side code (JavaScript running in browsers). All API calls should be made from your server.
  </Accordion>
</AccordionGroup>

## Authentication Errors

If authentication fails, you'll receive a `401 Unauthorised` response:

```json theme={null}
{
  "message": "API key is missing. Please provide a valid API key.",
  "data": [],
  "errors": []
}
```

Common causes of authentication failures:

| Error          | Cause                            | Solution                             |
| -------------- | -------------------------------- | ------------------------------------ |
| Missing header | No `Authorization` header        | Add the header to your request       |
| Invalid key    | Key doesn't exist or was deleted | Generate a new key in your dashboard |
| Wrong store    | Key belongs to a different store | Use the correct key for your store   |

## Rate Limiting

API keys are subject to rate limiting to ensure fair usage:

* **100 requests per minute** per API key

When rate limited, you'll receive a `429 Too Many Requests` response.

<Info>
  Need higher rate limits? Contact our support team at [support@chariow.com](mailto:support@chariow.com).
</Info>

## Next Steps

<CardGroup cols={2}>
  <Card title="API Reference" icon="code" href="/api-reference/introduction">
    Explore the complete API documentation
  </Card>

  <Card title="Rate Limits" icon="gauge-high" href="/en/resources/rate-limits">
    Learn more about rate limiting
  </Card>
</CardGroup>