> ## Documentation Index
> Fetch the complete documentation index at: https://docs.orbitforms.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> The OrbitForms API uses API keys to authenticate requests. You can manage your API keys from your dashboard.

The OrbitForms API uses API keys to authenticate requests. You can manage your API keys from your dashboard.

## API Keys

There are two types of API keys:

`sk_live_*` — Live keys for production use. All requests affect real data.

`sk_test_*` — Test keys for development. Isolated from production data.

## Using API Keys

Include your API key using either the `Authorization` header as a Bearer token, or the `X-API-Key` header:

```
Authorization: Bearer sk_live_your_api_key_here

# Or use the X-API-Key header:
X-API-Key: sk_live_your_api_key_here
```

Example request:

```bash theme={null}
curl -X GET "https://orbitforms.ai/api/v1/forms" \
  -H "Authorization: Bearer sk_live_your_api_key_here" \
  -H "Content-Type: application/json"

# Alternative with X-API-Key header:
curl -X GET "https://orbitforms.ai/api/v1/forms" \
  -H "X-API-Key: sk_live_your_api_key_here" \
  -H "Content-Type: application/json"
```

## OAuth 2.0

For third-party applications that need to access user data, use OAuth 2.0 with PKCE. OAuth access tokens use the `orb_at_*` prefix.

<Info>
  To build an OAuth app, visit the [Developer Portal](https://orbitforms.ai/developer) to register your application and obtain client credentials.
</Info>

## Security Best Practices

<Warning>
  **Keep keys secret** — Never expose API keys in client-side code, public repositories, or browser localStorage/sessionStorage.
</Warning>

<Note>
  **Use environment variables** — Store API keys in environment variables on your server. Never include them in frontend bundles.
</Note>

<Warning>
  **Rotate compromised keys** — If a key is exposed, revoke it immediately from your dashboard and generate a new one.
</Warning>

## Authentication Errors

| Status | Meaning                            |
| ------ | ---------------------------------- |
| `401`  | Invalid or missing API key         |
| `403`  | API key lacks required permissions |

[Next: Forms API](/developers/api/forms)