> ## Documentation Index
> Fetch the complete documentation index at: https://docs.oathnet.org/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Learn how to authenticate with the OathNet API using API keys

## API Key Authentication

All customer-facing OathNet API endpoints use API-key authentication. Include your key in the `x-api-key` header on every request.

<Warning>
  **IMPORTANT:** The header name must be lowercase: `x-api-key`
</Warning>

## Getting Your API Key

<Steps>
  <Step title="Sign In">
    Open [oathnet.org](https://oathnet.org) and sign in.
  </Step>

  <Step title="Open Account Settings">
    Open [Dashboard > Account](https://oathnet.org/dashboard?tab=account).
  </Step>

  <Step title="Copy the Key">
    Store it securely. Do not embed it in client-side code.
  </Step>
</Steps>

<Card title="Get Your API Key" icon="key" href="https://oathnet.org/dashboard?tab=account">
  Open the dashboard account page
</Card>

## Using Your API Key

<CodeGroup>
  ```bash cURL theme={null}
  curl -X GET "https://oathnet.org/api/service/v2/breach/search?q=test" \
    -H "x-api-key: YOUR_API_KEY"
  ```

  ```python Python theme={null}
  import os
  import requests

  API_KEY = os.environ.get("OATHNET_API_KEY")

  response = requests.get(
      "https://oathnet.org/api/service/v2/breach/search",
      params={"q": "test"},
      headers={"x-api-key": API_KEY}
  )
  ```

  ```javascript Node.js theme={null}
  const API_KEY = process.env.OATHNET_API_KEY;

  const response = await fetch(
    "https://oathnet.org/api/service/v2/breach/search?q=test",
    {
      headers: {
        "x-api-key": API_KEY
      }
    }
  );
  ```

  ```go Go theme={null}
  package main

  import (
      "net/http"
      "os"
  )

  func main() {
      apiKey := os.Getenv("OATHNET_API_KEY")

      req, _ := http.NewRequest(
          "GET",
          "https://oathnet.org/api/service/v2/breach/search?q=test",
          nil,
      )
      req.Header.Add("x-api-key", apiKey)

      _, _ = http.DefaultClient.Do(req)
  }
  ```
</CodeGroup>

## Using the Playground

<Steps>
  <Step title="Open an Endpoint">
    Open the [API Reference](/api-reference/overview), then select an operation
    from the generated OpenAPI playground.
  </Step>

  <Step title="Enter the Key">
    Expand the authorization panel in the playground and paste the API key.
  </Step>

  <Step title="Send a Request">
    Fill in the parameters and execute the request.
  </Step>
</Steps>

<Note>
  Your API key is stored locally in the browser and is only sent directly to the API server.
</Note>

## Authentication Errors

### 401 Unauthorized

Returned when the API key is missing or invalid.

### 403 Forbidden

Returned when the request is authenticated but the account lacks quota or plan access for that endpoint.

## Security Best Practices

<AccordionGroup>
  <Accordion title="Use Environment Variables" icon="leaf">
    Keep the API key in an environment variable or secret manager instead of hardcoding it.
  </Accordion>

  <Accordion title="Keep the Key Server-Side" icon="lock">
    Do not expose the key in browser bundles, client-side code, or public repositories.
  </Accordion>

  <Accordion title="Monitor Usage" icon="chart-line">
    Review usage in the dashboard if you suspect overuse, leakage, or a quota anomaly.
  </Accordion>
</AccordionGroup>

## Next Steps

<CardGroup cols={2}>
  <Card title="Quickstart" icon="rocket" href="/introduction/quickstart">
    Make your first request
  </Card>

  <Card title="Error Handling" icon="triangle-exclamation" href="/guides/error-handling">
    Handle auth and quota failures correctly
  </Card>
</CardGroup>