> ## Documentation Index
> Fetch the complete documentation index at: https://docs.swipelux.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Authenticate API requests with X-API-Key from your backend.

Keep every Swipelux API key on a protected backend. Never place a key in browser code, a mobile application bundle, or a client-visible configuration file.

## Send your API key

Use the shared base URL `https://platform.swipelux.com` and send your key in the `X-API-Key` header.

```bash theme={null}
export API_BASE='https://platform.swipelux.com'
export SWIPELUX_API_KEY='replace-with-your-api-key'

curl --request GET \
  "${API_BASE}/v3/capabilities" \
  --header "X-API-Key: ${SWIPELUX_API_KEY}"
```

[`GET /v3/capabilities`](/api-reference/capabilities/get-v3-capabilities) confirms that the key is valid and your backend can reach the API.

## Sandbox and production

Sandbox and production use the same API host. The API key selects the environment.

Keep the environment choice in deployment configuration. A production deployment must never fall back to a sandbox key, and a sandbox deployment must never receive production credentials.

## Store credentials safely

Store sandbox and production keys in separate secret-manager entries. Grant each backend deployment access only to the entry it needs.

Keep keys out of source control, logs, analytics, support screenshots, and error responses. Rotate a key if you believe it has been exposed.

Next, [configure sandbox testing](/integration/sandbox) or start the [Quickstart](/integration/quickstart).