> ## Documentation Index
> Fetch the complete documentation index at: https://docs.morphic.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Authenticate your API requests using API keys.

All API endpoints require authentication. The recommended method for integrations is an **API key**.

## API key authentication

Pass your API key in the `X-API-Key` header:

<CodeGroup>
  ```bash cURL theme={null}
  curl -X GET "https://api.morphic.io/api/contacts" \
    -H "X-API-Key: sk_your_api_key_here"
  ```

  ```python Python theme={null}
  import requests

  headers = {"X-API-Key": "sk_your_api_key_here"}
  response = requests.get(
      "https://api.morphic.io/api/contacts",
      headers=headers,
  )
  ```

  ```javascript JavaScript theme={null}
  const response = await fetch("https://api.morphic.io/api/contacts", {
    headers: { "X-API-Key": "sk_your_api_key_here" },
  });
  ```
</CodeGroup>

## Key format

API keys use the prefix `sk_` followed by a random string:

```
sk_a1b2c3d4e5f6g7h8i9j0...
```

## Creating an API key

1. Log in to your Morphic dashboard
2. Go to **Settings** > **Developer Settings**
3. Click **Create API Key**
4. Copy the key immediately (it won't be shown again)

<Warning>
  API keys grant full access to your account's data. Never expose them in client-side code, public repositories, or logs.
</Warning>

## Alternative: JWT authentication

For browser-based sessions, the API also accepts JWT tokens from Supabase Auth:

```
Authorization: Bearer <jwt_token>
X-Account-ID: <account_uuid>
```

JWT authentication requires both headers. This method is primarily used by the Morphic web application.

## Authentication errors

| Status | Meaning                                        |
| ------ | ---------------------------------------------- |
| `401`  | Missing or invalid API key / token             |
| `403`  | Valid credentials but insufficient permissions |