> ## Documentation Index
> Fetch the complete documentation index at: https://docs.wizcommerce.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> How to authenticate and manage API keys to access the API

To authenticate and access the API, you need to pass your **API Key** in the `X-API-Key` header with each request.

## Overview

API authentication is token-based. You generate an API token using your email and password, then include that token in the `X-API-Key` header for all authenticated requests.

## API Reference

For detailed information about authentication endpoints:

* [Generate Token](/api-reference/auth/create-token)
* [Revoke Token](/api-reference/auth/revoke-token)

<Note>
  Please note that generated tokens will be expired after 1 year automatically. Once it is expired, please generate new token.
</Note>

## Token Security

⚠️ **Best Practices:**

* ✅ **Keep tokens secure** - Never commit them to version control
* ✅ **Use environment variables** - Store tokens in `.env` files
* ✅ **Rotate regularly** - Generate new tokens periodically
* ✅ **Revoke compromised tokens** - Delete immediately if exposed
* ✅ **Use different tokens** - Separate tokens for different applications

## Error Responses

### Invalid or Missing API Key

```json theme={null}
{
  "code": "INVALID_API_KEY",
  "message": "Invalid API key"
}
```

**HTTP Status:** `401 Unauthorized`

### Expired Token

```json theme={null}
{
  "code": "TOKEN_EXPIRED",
  "message": "API token has expired. Please create a new token."
}
```

**HTTP Status:** `401 Unauthorized`