> ## Documentation Index
> Fetch the complete documentation index at: https://dev.enterprise.moonpay.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Authenticate MoonPay Enterprise API requests using the X-API-Key header. Includes example requests, 401 error handling, and common troubleshooting steps.

## Authenticating Requests with API Keys

To make successful requests to the MoonPay Enterprise API, you must authenticate every request by including a valid API key in the request headers. Authentication checks that only authorized users can access resources or perform actions within the API. [Learn how to generate API Keys here.](/api-access)

## Including the API Key

Include your API key in the `X-API-Key` header of every request. If the API key is missing, incorrect, or revoked, the request will fail.

### Example Request

The following example demonstrates how to use your API key with a `GET` request to fetch a list of customers:

<CodeGroup>
  ```bash Bash theme={null}
  curl --request GET \
       --url https://api.sandbox.iron.xyz/api/customers \
       --header 'X-API-Key: YOUR-API-KEY' \
       --header 'accept: application/json; charset=utf-8'
  ```

  ```typescript TypeScript theme={null}
  const response = await fetch("https://api.sandbox.iron.xyz/api/customers", {
    headers: {
      "X-API-Key": "YOUR-API-KEY",
      "accept": "application/json; charset=utf-8",
    },
  });

  const customers = await response.json();
  ```

  ```python Python theme={null}
  import requests

  response = requests.get(
      "https://api.sandbox.iron.xyz/api/customers",
      headers={
          "X-API-Key": "YOUR-API-KEY",
          "accept": "application/json; charset=utf-8",
      },
  )

  customers = response.json()
  ```
</CodeGroup>

<Note>
  Replace `YOUR-API-KEY` with the actual API key you generated. The `X-API-Key` header is required for every request to authenticate your access. This example uses the Sandbox base URL. For Production, send requests to `https://api.iron.xyz`. See [API Access](/api-access) for both environments.
</Note>

## Handling Authentication Errors

If the API key is missing, invalid, or revoked, the server responds with a `401 Unauthorized` error. All three cases return the same response:

```bash theme={null}
< HTTP/2 401
< content-type: text/plain; charset=utf-8
< content-length: 59
<
Missing or invalid authentication. Please provide X-API-Key
```

<Warning>
  Unlike other API errors, authentication failures return a plain-text body, not JSON. Don't parse the `401` response body as JSON.
</Warning>

### Common Causes of Authentication Errors

1. **Incorrect API Key**: Check that the key matches the one you generated.
2. **Revoked API Key**: Verify that the key has not been revoked.
3. **Missing API Key**: Confirm the `X-API-Key` header is included in your request.

### How to Resolve

* Double-check the API key and its permissions in the Partner Dashboard.
* Generate a new key if necessary and update your requests with the new key.