> ## Documentation Index
> Fetch the complete documentation index at: https://docs.bringin.app/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> API keys and how auth works

All API requests require an `api-key` header:

```bash theme={null}
api-key: ZTY3YzNhMzQ3Yzk4NGJjMmEwZWU1NTQ4NmE5MjJjZTk=
```

## Two Types of Keys

| Key              | What it's for                                                                 | How to get it                                                  |
| ---------------- | ----------------------------------------------------------------------------- | -------------------------------------------------------------- |
| **Master key**   | Onboarding users, getting signup links, checking rates                        | Provided by Bringin during partner setup                       |
| **Per-user key** | Creating orders, checking balance, listing transactions, managing connections | Returned after connecting a user (via API response or webhook) |

The master key identifies your application. The per-user key identifies a specific user within your app.

<Info>Per-user keys have limited permissions — they can only push crypto for conversion. Safe to store on client devices.</Info>

## When is HMAC needed?

Only when you call `POST /application/connect` with a `callback` URL (webhook-enabled onboarding). HMAC proves the request came from your server.

If you don't use webhooks, you don't need HMAC.

See [HMAC Signing](/authentication/hmac-signing) for the step-by-step process.

## Headers

Both `api-key` and `x-api-key` are accepted. Keys may optionally have prefixes (`pk_live_`, `sk_test_`, etc.) — these are stripped automatically.