> ## Documentation Index
> Fetch the complete documentation index at: https://docs.shakesco.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Authenticate your API requests across all Shakesco products

<span style={{display:"none"}}>For the complete documentation index, see [llms.txt](/llms.txt).</span>

## API Key Authentication

All Shakesco API requests require authentication using bearer tokens, regardless of which API product you're using.

## Getting Your API Key

<Steps>
  <Step title="Create account">
    Sign up at [users.shakesco.com](https://users.shakesco.com/login)
  </Step>

  <Step title="Get API key">
    Navigate to **API Tokens** in your dashboard and generate a key
  </Step>
</Steps>

## Using Your API Key

Include your API key in the `Authorization` header for all requests:

```bash theme={null}
Authorization: Bearer YOUR_API_KEY
```

**Payment Links / Invoices example:**

```javascript theme={null}
const response = await fetch("https://payments.shakesco.com/invoices", {
  method: "POST",
  headers: {
    Authorization: "Bearer uHdONhRNd98285c4...",
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    // request body
  }),
});
```

**Loyalty Tokens example:**

```javascript theme={null}
const response = await fetch("https://tokens.shakesco.com/claim-tokens", {
  method: "POST",
  headers: {
    Authorization: "Bearer uHdONhRNd98285c4...",
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    // request body
  }),
});
```

**Auto-Payments example:**

```javascript theme={null}
const response = await fetch("https://payments.shakesco.com/request", {
  method: "POST",
  headers: {
    Authorization: "Bearer uHdONhRNd98285c4...",
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    // request body
  }),
});
```

## API Products & Base URLs

| API Product    | Base URL                        | Get Started                                                 |
| -------------- | ------------------------------- | ----------------------------------------------------------- |
| Payment Links  | `https://payments.shakesco.com` | [Invoice API](/api-reference/payment-links/invoices/create) |
| Loyalty Tokens | `https://tokens.shakesco.com`   | [Tokens API](/api-reference/tokens/overview)                |
| Auto-Payments  | `https://payments.shakesco.com` | [Deploy guide](/auto-payments/)                             |

## Security Best Practices

<Warning>
  **Never embed your API key in browser or mobile-client code.** Shakesco APIs
  are designed for server-to-server calls only. A leaked key lets anyone act as
  your business until you rotate it.
</Warning>

**Recommended:**

* Always call Shakesco APIs from your backend, never from a browser or mobile app
* Store API keys in environment variables on your server
* Rotate keys periodically
* Never commit keys to version control

**Example with environment variables:**

```javascript theme={null}
const API_KEY = process.env.SHAKESCO_API_KEY;

const response = await fetch("https://payments.shakesco.com/invoices", {
  headers: {
    Authorization: `Bearer ${API_KEY}`,
  },
});
```

## Testing

For Auto-Payments you can verify integration without charges using the test endpoints:

* `/delegate_address`: Get test user address
* `/buss_delegate_address`: Get test business address

## Authentication Errors

**401 Unauthorized**

Missing or invalid API key:

```json theme={null}
{
  "error": "Unauthorized"
}
```

**Solutions:**

* Verify API key is correct
* Check `Bearer ` prefix is included
* Ensure the key is active in your dashboard

**403 Forbidden**

Valid API key but insufficient permissions:

```json theme={null}
{
  "error": "Forbidden"
}
```

**Solutions:**

* Verify the account is fully set up
* Ensure .sns username is registered (for payment links)