---
title: "Authentication"
description: "Authentication"
---

# Authentication

The external REST API authenticates with **admin-issued API keys** sent in the
`X-API-Key` header (not an app login token):

```http
GET /api/v1/employees HTTP/1.1
X-API-Key: <your-api-key>
```

Each key is bound to one organization and a set of scopes. The secret is shown
exactly once at creation and is never stored in readable form, so copy it right
away. Revoked or expired keys are rejected, every route requires its own scope
(default deny), and usage is rate limited per key.