> ## Documentation Index
> Fetch the complete documentation index at: https://developers.getswipe.in/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> How to authenticate Swipe API requests with your API key.

All Swipe API requests are authenticated with an API key sent as a Bearer token.

## Base URL

Every endpoint in this documentation is relative to:

```
https://app.getswipe.in/api/partner
```

For example, the [Create a document](/api-reference/document-v2/create-a-document) endpoint `POST /v2/doc` resolves to `https://app.getswipe.in/api/partner/v2/doc`.

## Getting your API key

1. Sign in to your [Swipe dashboard](https://app.getswipe.in).
2. Open the [API Integration](https://app.getswipe.in/user?tab=api_integration) section.
3. Generate your API key and copy it.

The key is tied to your Swipe account — every document, customer, and product you create through the API belongs to that account.

## Using the key

Send the key in the `Authorization` header of every request:

```bash theme={null}
curl --request GET \
  --url https://app.getswipe.in/api/partner/v2/product/list \
  --header "Authorization: Bearer YOUR_API_KEY"
```

In the [API playground](/api-reference/document-v2/create-a-document), paste the key into the **Authorization** field and it is applied to every try-it request.

## Authentication errors

Requests with a missing or invalid key fail with HTTP `401` and one of these error codes:

| `error_code`   | Meaning                                                             |
| -------------- | ------------------------------------------------------------------- |
| `UNAUTHORIZED` | The key is missing, malformed, or invalid. Check the header format. |
| `FORBIDDEN`    | The key is not allowed to perform this action.                      |

See [Error codes](/api-reference/error-codes) for the full list.

## Keeping your key safe

<Warning>
  Your API key grants full access to your Swipe account's data. Treat it like
  a password.
</Warning>

* Call the API **from your server only** — never embed the key in browser JavaScript, mobile apps, or public repositories.
* Store it in an environment variable or a secrets manager, not in source code.
* If a key is exposed, regenerate it from the [API Integration](https://app.getswipe.in/user?tab=api_integration) page and update your servers with the new key.