> ## Documentation Index
> Fetch the complete documentation index at: https://api.scalysis.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication: Securing Your Scalysis API Requests

> Learn how to generate your Scalysis API key and authenticate every request using the Authorization Bearer or X-API-Key header formats.

Every request to the Scalysis API must be authenticated with a valid API key. Scalysis uses key-based authentication — there are no OAuth flows or session tokens to manage. You include your key in a request header, and Scalysis verifies it on every call. This page explains how to generate your key, which header format to use, and what to do if authentication fails.

## Getting your API key

API keys are generated from the Scalysis dashboard. Log in at [https://app.scalysis.com](https://app.scalysis.com), open the **Integrations** section in the sidebar, and click **API Keys**. From there, click **Create new key**, give it a meaningful label so you can identify it later (for example, `production-backend` or `staging-tests`), and copy the key immediately after it is created.

All Scalysis API keys begin with the prefix `sca_` followed by a long random string, for example:

```text theme={null}
sca_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
```

<Warning>
  Your API key is shown **only once** at the moment of creation. If you lose it, you will need to revoke it and create a new one. Never share your API key in screenshots, support chats, or public code repositories — anyone with your key can make authenticated API calls on your behalf.
</Warning>

## Using your API key

Scalysis supports two equivalent header formats for passing your API key. Use whichever fits better with your HTTP client or existing conventions — both grant the same level of access.

<CodeGroup>
  ```bash Option A: Authorization Bearer theme={null}
  curl -sS -X POST 'https://app.scalysis.com/api/v1/calls/trigger' \
    -H 'Authorization: Bearer YOUR_API_KEY' \
    -H 'Content-Type: application/json' \
    -d '{ "scriptId": 2207, "customerPhone": "9149874123" }'
  ```

  ```bash Option B: X-API-Key Header theme={null}
  curl -sS -X POST 'https://app.scalysis.com/api/v1/calls/trigger' \
    -H 'X-API-Key: YOUR_API_KEY' \
    -H 'Content-Type: application/json' \
    -d '{ "scriptId": 2207, "customerPhone": "9149874123" }'
  ```
</CodeGroup>

Both examples above are functionally identical. Pick one and use it consistently across your integration to keep your codebase easy to reason about.

## Required headers for POST requests

Any request that sends a JSON body — such as triggering a call or creating a campaign — must also include the `Content-Type: application/json` header. Without it, the Scalysis API cannot parse the request body and will return an error.

```bash theme={null}
-H 'Content-Type: application/json'
```

`GET` requests, such as fetching a call outcome, do not require a `Content-Type` header because they carry no body.

<Info>
  As a rule of thumb: if you're sending a `-d` flag (or any request body) in your HTTP client, always include `Content-Type: application/json` alongside your authentication header.
</Info>

## Authentication errors

If your API key is missing, malformed, or has been revoked, the Scalysis API responds with an HTTP `401 Unauthorized` status and a JSON error body:

```json theme={null}
{
  "success": false,
  "error": "Unauthorized",
  "message": "Invalid or missing API key"
}
```

Common reasons for a `401` response:

* You forgot to include the authentication header entirely.
* You copied the key incorrectly — double-check for missing characters or accidental whitespace.
* The key was revoked from the dashboard (for example, after a suspected leak).
* You are using a key generated for a different Scalysis account.

<Tip>
  If you suspect your API key has been compromised — for example, it was accidentally committed to a public repository — go to **Integrations → API Keys** in the dashboard and revoke the key immediately. Then generate a fresh one and update your environment variables or secrets vault. Revocation takes effect instantly, so any requests using the old key will fail from that point forward.
</Tip>