> ## Documentation Index
> Fetch the complete documentation index at: https://docs.kasiye.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Authenticate workspace API requests with your secret key.

Every request to `https://api.kasiye.com/v1` must include your workspace secret key. Keys start with `shp_` and are unique to one workspace.

## Get a key

1. Sign in at [kasiye.com](https://kasiye.com).
2. Open **Settings → API**.
3. Copy the secret key. Kasiye creates one automatically if the workspace does not have a key yet.

Regenerate the key from the same page if it is exposed. The previous key stops working immediately.

## Send the key

Use either header. Bearer is checked first.

<Tabs>
  <Tab title="Bearer token">
    ```bash theme={null}
    curl https://api.kasiye.com/v1/shipments \
      -H "Authorization: Bearer shp_your_key"
    ```
  </Tab>

  <Tab title="X-Api-Key">
    ```bash theme={null}
    curl https://api.kasiye.com/v1/shipments \
      -H "X-Api-Key: shp_your_key"
    ```
  </Tab>
</Tabs>

<ParamField path="header.Authorization" type="string" required>
  `Bearer` followed by your `shp_` secret key.
</ParamField>

<ParamField path="header.X-Api-Key" type="string">
  Alternative to `Authorization`. Same `shp_` secret key.
</ParamField>

## Errors

Missing or invalid keys return `401`:

```json theme={null}
{
  "message": "Unauthenticated."
}
```

Shipments that belong to another workspace return `404`, not `403`. The API does not confirm that the reference exists outside your workspace.

## Rate limits

Authenticated requests are limited to **60 per minute** per workspace. When you exceed the limit, the API returns `429`.

## Webhook key

The same settings page also shows a webhook key (`whsec_`) and an optional endpoint URL. Use the webhook key to verify events Kasiye sends to your server. It is not valid as an API request credential.