> For the complete documentation index, see [llms.txt](https://docs.paypangea.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.paypangea.com/crypto-payments/api-integration/authentication.md).

# Authentication

Authenticating your API requests is essential to ensure secure communication between your application and PayPangea's services. Each request must include an Authorization header, using a bearer token format, to be properly authorized.

### Making Authenticated API Requests

To authenticate your API requests to PayPangea, you will include your `API_KEY` in the Authorization header as a Bearer token. Here is how you can structure your request:

#### Example API Request

This example demonstrates making a POST request to the PayPangea API to initiate a fiat payment request. Ensure you replace `API_KEY` with the actual API key obtained from PayPangea.

```http
POST https://api.paypangea.com/v1/pay/{endpoint}
Content-Type: application/json
Authorization: Bearer API_KEY
```

#### Detailed Steps

1. **Prepare the API request**: Compose your HTTP request to target the specific PayPangea API endpoint you wish to interact with. In this case, we're using `/v1/pay/request-pay-sdk-fiat`.
2. **Include the API Key**: Replace `API_KEY` in the Authorization header with your actual PayPangea API key.
3. **Set the Content-Type**: Ensure the `Content-Type` header is set to `application/json` to indicate the format of the request body.
4. **Send the request**: Use your preferred HTTP client or tool to send the request to PayPangea's API server.

### Handling API Responses

The PayPangea API will respond with various HTTP status codes to indicate the success or failure of your request. A successful request typically returns a `200 OK` status code, along with any requested data in the response body. It's important to handle different responses and status codes appropriately in your application.

### Security Best Practices

* **Secure Your API Key**: Treat your `API_KEY` as sensitive information. Do not hard-code it in your application's source code. Instead, use environment variables or secure secrets management tools.
* **Use HTTPS**: Ensure all API requests are made over HTTPS to protect the data in transit.
* **Monitor and Rotate Keys**: Regularly monitor the usage of your API key and rotate it periodically to maintain security.