> ## Documentation Index
> Fetch the complete documentation index at: https://docs.truenroll.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> How partner API keys work and how to send them.

The Partner API uses API key authentication. Keys are scoped to a specific organization and
must be explicitly provisioned as partner-type keys. Internal platform keys are rejected
on partner routes.

## Getting a partner API key

Partner API keys are provisioned by your TruEnroll account manager. To request one, provide:

* Your organization name and registered email address
* The intended use case (the service or product that will use the key)
* The environments you need keys for (staging, production)

## Sending the key

Include your partner API key in every request using either header:

<Tabs>
  <Tab title="x-api-key header (recommended)">
    ```bash theme={null}
    curl https://api.truenroll.com/partner/v1/cases \
      -H "x-api-key: te_partner_live_xxxxxxxxxxxxxxxx"
    ```
  </Tab>

  <Tab title="Authorization: Bearer">
    ```bash theme={null}
    curl https://api.truenroll.com/partner/v1/cases \
      -H "Authorization: Bearer te_partner_live_xxxxxxxxxxxxxxxx"
    ```
  </Tab>
</Tabs>

Both headers are accepted. `x-api-key` is recommended for clarity: it's immediately obvious
this is an API key and not a JWT token.

## Error responses

| Code               | Meaning                                                                    |
| ------------------ | -------------------------------------------------------------------------- |
| `401 Unauthorized` | No API key provided, or the key is invalid or expired                      |
| `403 Forbidden`    | Key is inactive, or is not a partner-type key (e.g., it's an internal key) |

```json theme={null}
{
  "statusCode": 401,
  "message": "Invalid or expired API key"
}
```

## Key security

<Warning>
  Treat your partner API key like a password. It authenticates requests as your organization
  and carries all of your organization's provisioned features.
</Warning>

* **Never commit keys to version control.** Use environment variables or a secrets manager.
* **Use separate keys per environment.** Don't use a production key in your staging or
  development environment.
* **Rotate keys if compromised.** Contact your TruEnroll account manager to revoke a
  key and issue a replacement immediately.

## Multiple keys

An organization can have multiple partner API keys, which is useful for separating services,
environments, or teams. Each key is independent; revoking one does not affect the others.

## Webhook endpoint authentication

Webhooks work the other way around: TruEnroll calls *your* endpoint. It authenticates by
sending the secret key you registered as an **`x-api-key` header** on every delivery, which
you verify before acting on the request. See
[Authenticating webhook requests](/partner-api/webhooks#authenticating-webhook-requests) for details.