> ## Documentation Index
> Fetch the complete documentation index at: https://docs.hyparrow.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Authenticating requests to the Hyparrow API.

Every request is authenticated with your **API key credentials**, sent as two headers:

```
X-API-Key: <your-api-key>
X-API-Secret: <your-api-secret>
```

<Card title="API key" icon="key">
  Created from your dashboard's API keys page. Used for server-to-server
  integrations. Keep both the key and secret secret — never expose them in
  client-side code.
</Card>

<Note>
  The **API keys** page lives in the **Developer** extension. If you don't see
  it, open **Extensions** in your dashboard and install **Developer** first.
</Note>

## Example

```bash theme={null}
curl https://api.hyparrow.cloud/api/v1/kyc/balance \
  -H "X-API-Key: <your-api-key>" \
  -H "X-API-Secret: <your-api-secret>"
```

Missing or invalid credentials return `401 Unauthorized`
(`Missing API credentials` or `Invalid API credentials`). A key that
authenticates but may not be used — wrong environment, disabled, expired, or
calling from a non-allow-listed IP — returns `403 Forbidden`.

## Test vs live keys

Keys come in two environments. **Live** keys (`pk_live_`) work against
`api.hyparrow.cloud` and move real money. **Test** keys (`pk_test_`) work only
against the [Sandbox](/sandbox) at `sandbox.hyparrow.cloud`, where every
provider is simulated. A key from one environment is rejected by the other with
`403 Forbidden`, so a test key can never touch production. Create either kind by
switching your dashboard between Live and Sandbox mode.