> ## Documentation Index
> Fetch the complete documentation index at: https://docs.xerobi.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Secure your API requests with proper authentication

## API Authentication

All Xerobi API requests require authentication to ensure security and proper access control. We support Bearer token authentication with API versioning.

## Authentication Methods

### Bearer Token Authentication

Include your API key in the `Authorization` header using the Bearer scheme:

```bash theme={null}
curl -X GET "https://api.hixbe.com/payment/payment_intents" \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Xerobi-Version: 2026-01-01"
```

```javascript JavaScript theme={null}
const response = await fetch('https://api.hixbe.com/payment/payment_intents', {
  method: 'GET',
  headers: {
    'Authorization': 'Bearer YOUR_API_KEY',
    'Xerobi-Version': '2026-01-01',
    'Content-Type': 'application/json'
  }
});
```

```python Python theme={null}
import requests

headers = {
    'Authorization': 'Bearer YOUR_API_KEY',
    'Xerobi-Version': '2026-01-01',
    'Content-Type': 'application/json'
}

response = requests.get('https://api.hixbe.com/payment/payment_intents', headers=headers)
```

```php PHP theme={null}
<?php
$ch = curl_init();

curl_setopt($ch, CURLOPT_URL, 'https://api.hixbe.com/payment/payment_intents');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($ch, CURLOPT_HTTPHEADER, [
    'Authorization: Bearer YOUR_API_KEY',
    'Xerobi-Version: 2026-01-01',
    'Content-Type: application/json'
]);

$response = curl_exec($ch);
curl_close($ch);
?>
```

## API Keys

### Types of API Keys

* **Secret Keys**: Full access to all API operations. Keep these secure and never expose them in client-side code.
* **Publishable Keys**: Limited access for client-side operations (e.g., payment form integration).
* **Restricted Keys**: Scoped access with specific permissions and resource limitations.

### Managing API Keys

**1. Access your dashboard**

Log in to [dash.hixbe.com](https://dash.hixbe.com) and navigate to the API Keys section.

**2. Create a new key**

1. Click "Create API Key"
2. Choose the key type (Secret, Publishable, or Restricted)
3. Set permissions and restrictions if applicable
4. Add a descriptive name for tracking

**3. Secure your keys**

* Store keys as environment variables
* Use secret management services (AWS Secrets Manager, Azure Key Vault, etc.)
* Rotate keys regularly
* Never commit keys to version control

## API Versioning

All requests must include the `Xerobi-Version` header to specify which API version to use:

```bash theme={null}
-H "Xerobi-Version: 2026-01-01"
```

> [!NOTE]
>
> **Current version**: `2026-01-01`
>
> We recommend always specifying the latest version to access the newest features and improvements.

## Security Best Practices

### Key Security

* Never expose secret keys in client-side code
* Use environment variables for key storage
* Rotate keys every 90 days
* Monitor key usage in your dashboard
* Use restricted keys when possible

### Request Security

* Always use HTTPS for all API requests
* Validate SSL certificates
* Implement proper error handling
* Use idempotency keys for critical operations
* Rate limit your requests appropriately

### Environment Separation

* Use separate API keys for sandbox and production
* Test thoroughly in sandbox before going live
* Implement environment-specific configurations
* Use different subdomains for testing vs production

## Authentication Errors

### Common Error Codes

| Error Code | Description | Solution |
| - | - | - |
| `INVALID_API_KEY` | The provided API key is invalid | Check your API key and ensure it's correct |
| `MISSING_AUTH_HEADER` | Authorization header is missing | Include the Authorization header with Bearer token |
| `INSUFFICIENT_PERMISSIONS` | API key lacks required permissions | Create a key with appropriate permissions or contact support |
| `EXPIRED_API_KEY` | The API key has expired | Generate a new API key in your dashboard |
| `INVALID_VERSION` | Unsupported API version | Use a supported version (currently `2026-01-01`) |

### Error Response Format

```json theme={null}
{
  "success": false,
  "error": {
    "code": "INVALID_API_KEY",
    "message": "The API key provided is invalid",
    "details": {
      "provided_key_prefix": "sk_test_..."
    }
  }
}
```

## Testing Authentication

Use our sandbox environment to test authentication without affecting production data:

```bash theme={null}
# Sandbox URL
curl -X GET "https://sandbox.api.hixbe.com/payment/payment_intents" \
  -H "Authorization: Bearer YOUR_SANDBOX_KEY" \
  -H "Xerobi-Version: 2026-01-01"
```

> [!NOTE]
>
> Sandbox and production use separate API keys and data. Always test authentication in sandbox first.

## Need Help?

> [card] [Troubleshooting](https://docs.xerobi.com/faq-guides/troubleshooting)
>
> Common authentication issues and solutions

> [card] [Best Practices](https://docs.xerobi.com/faq-guides/best-practices.md)
>
> Security and integration best practices

> [card] [API Versioning](https://docs.xerobi.com/faq-guides/versioning.md)
>
> Learn about API versioning requirements

> [card] [Support](mailto:support@xerobi.com)
>
> Contact our support team


## Related topics

- [Xerobi Certification & Badge API Introduction](https://docs.xerobi.com/certify/introduction.md)
- [Xerobi Payment API Introduction](https://docs.xerobi.com/payment-api/introduction.md)
- [Xerobi SMS Gateway API Introduction](https://docs.xerobi.com/sms-api/introduction.md)
- [Xerobi Fiber API](https://docs.xerobi.com/network-api/introduction.md)
- [RPKI API](https://docs.xerobi.com/rpki-api/introduction.md)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.