> ## Documentation Index
> Fetch the complete documentation index at: https://docs.leapfinancial.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Integrator API keys via X-API-Key on versioned request-money routes, common errors, and secure handling practices.

The OpenAPI document defines **`api_key`** security for **`/v1/request-money`**. You authenticate by sending your integrator secret on every protected request.

## API key

| Item            | Detail                                                                                 |
| --------------- | -------------------------------------------------------------------------------------- |
| Header          | **`X-API-Key`**                                                                        |
| Scope           | Per environment (sandbox vs production). Use the key issued for the base URL you call. |
| Sandbox host    | `https://{raas-backend-sandbox}` (versioned root: `.../v1`)                            |
| Production host | `https://{raas-backend-production}` (versioned root: `.../v1`)                         |

## Example

<CodeGroup>
  ```bash cURL theme={null}
  curl -sS "$BASE_URL/v1/request-money/Ab3xY9mK" \
    -H "X-API-Key: YOUR_API_KEY"
  ```

  ```python Python theme={null}
  import os
  import requests

  base = os.environ["BASE_URL"].rstrip("/")
  key = os.environ["REQUEST_API_KEY"]
  ref = "Ab3xY9mK"

  r = requests.get(
      f"{base}/v1/request-money/{ref}",
      headers={"X-API-Key": key},
      timeout=30,
  )
  print(r.status_code, r.text)
  ```

  ```javascript Node.js theme={null}
  import process from "node:process";

  const base = process.env.BASE_URL.replace(/\/$/, "");
  const key = process.env.REQUEST_API_KEY;
  const ref = "Ab3xY9mK";

  const res = await fetch(`${base}/v1/request-money/${ref}`, {
    headers: { "X-API-Key": key },
  });

  console.log(res.status, await res.text());
  ```
</CodeGroup>

## Error responses

| HTTP status                  | When it happens                                                                                                         |
| ---------------------------- | ----------------------------------------------------------------------------------------------------------------------- |
| **401 Unauthorized**         | Missing or invalid **`X-API-Key`**.                                                                                     |
| **403 Forbidden**            | **`POST`** when the request is blocked by screening (for example OFAC).                                                 |
| **404 Not Found**            | **`GET`** when the resource is not found for that `referenceId` (see OpenAPI for the error body).                       |
| **422 Unprocessable Entity** | Validation failures on **`POST`** or invalid **`referenceId`** on **`GET`** (shape and rules as documented in OpenAPI). |

<AccordionGroup>
  <Accordion title="Do not log secrets">
    Strip or redact **`X-API-Key`** values from application logs, APM traces, and support bundles.
  </Accordion>

  <Accordion title="Gateways and mTLS">
    Your host may terminate TLS, enforce IP allowlists, or require mutual TLS in front of this service. Treat this page as the contract for the application process; follow any additional controls your integration contact documents.
  </Accordion>

  <Accordion title="Rotating keys">
    Plan a key rotation with your integration contact so you can switch **`REQUEST_API_KEY`** and client headers without downtime, if your deployment supports overlapping keys.
  </Accordion>
</AccordionGroup>