> ## Documentation Index
> Fetch the complete documentation index at: https://docs.leapfinancial.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Authenticate Partner API requests with X-API-Key (raas_sandbox_ / raas_live_)

## API keys

All requests to the RaaS Widgets Partner API require an API key in the `X-API-Key` header. Create and revoke keys in the [Partner Portal](https://raas-widgets-partner-portal-sandbox.up.railway.app/).

### Key format

| Prefix          | Environment | Example                      |
| --------------- | ----------- | ---------------------------- |
| `raas_sandbox_` | Sandbox     | `raas_sandbox_a1b2c3d4e5f6…` |
| `raas_live_`    | Production  | `raas_live_a1b2c3d4e5f6…`    |

<Warning>
  API keys are shown only once when created. Store them securely — you cannot retrieve the full key later.
</Warning>

### Using your API key

<CodeGroup>
  ```bash cURL theme={null}
  curl -X GET https://raas-widgets-backend-sandbox.up.railway.app/partner/me \
    -H "X-API-Key: raas_sandbox_your_api_key_here"
  ```

  ```javascript Node.js theme={null}
  const response = await fetch(
    'https://raas-widgets-backend-sandbox.up.railway.app/partner/me',
    {
      headers: { 'X-API-Key': process.env.RAAS_API_KEY },
    },
  );
  ```

  ```python Python theme={null}
  import os, requests

  response = requests.get(
      'https://raas-widgets-backend-sandbox.up.railway.app/partner/me',
      headers={'X-API-Key': os.environ['RAAS_API_KEY']},
  )
  ```
</CodeGroup>

### Managing keys

From the Partner Portal you can create, revoke, and monitor keys. Prefer separate keys per service so you can rotate without a full outage.

<Tip>
  Never commit API keys to source control. Load them from a secret manager or environment variables.
</Tip>

## Authentication errors

### Missing API key

```json theme={null}
{
  "success": false,
  "error": {
    "code": "MISSING_API_KEY",
    "message": "X-API-Key header is required"
  }
}
```

### Invalid API key

```json theme={null}
{
  "success": false,
  "error": {
    "code": "INVALID_API_KEY",
    "message": "Invalid or revoked API key"
  }
}
```

## Webhook signatures

Outbound webhooks are signed with HMAC-SHA256. Verification uses these headers:

| Header             | Purpose        |
| ------------------ | -------------- |
| `X-RAAS-Signature` | HMAC signature |
| `X-RAAS-Timestamp` | Unix timestamp |
| `X-RAAS-Event`     | Event name     |

See [Webhook Security](/raas-widgets/webhooks/security) for verification examples.

## Scope of this API

This documentation covers the **Partner-accessible API** only. Flow widgets authenticate to the backend with magic-link JWTs (Widget API), and Leap operators use the Superadmin API — those surfaces are not documented here.

## Next steps

<CardGroup cols={2}>
  <Card title="Quick Start" icon="rocket" href="/raas-widgets/quickstart">
    Mint your first link.
  </Card>

  <Card title="Create links" icon="link" href="/raas-widgets/guides/create-links">
    Full create-link contract.
  </Card>
</CardGroup>