> ## Documentation Index
> Fetch the complete documentation index at: https://docs.outseta.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> How to authenticate requests to the Outseta API.

The Outseta API supports two authentication schemes. Pick the one that matches your use case.

## API key (server-to-server)

Use API keys when calling the API from a backend you control. Each key has a paired secret — together they're sent in the `Authorization` header.

```http theme={null}
Authorization: Outseta <API_KEY>:<SECRET_KEY>
```

You can generate keys from the Outseta admin console under **Settings → API Keys**.

<Warning>
  Never embed an API key + secret in client-side code (browsers, mobile apps). Use bearer tokens for those flows.
</Warning>

## Bearer token (client-side)

For client-side calls (e.g. a logged-in user fetching their own data), use a JWT access token issued by the Outseta auth flow.

```http theme={null}
Authorization: bearer <ACCESS_TOKEN>
```

Tokens are short-lived and should be refreshed using the standard OAuth refresh flow.

## Choosing between them

| Use case                                              | Scheme       |
| ----------------------------------------------------- | ------------ |
| Backend job, webhook handler, server-side integration | API key      |
| Logged-in browser/mobile session                      | Bearer token |
| Public, unauthenticated endpoints (e.g. signup)       | None         |