# Authentication

All requests to the JondaX API require a Bearer token.

Your API key is like a password that identifies your account. You include it in every request so JondaX knows who you are and which organisation the data belongs to. Keep it private — never share it publicly or put it in client-side code that end users can see.

## Getting your API key

Retrieve your API key from the **Integration** section under **Settings** in the JondaX client portal at [https://app.jondax.eu/login](https://app.jondax.eu/login).

![API key on the Integration page](/assets/integration-api-key.508592ff43193fc58c08c0bac876f6d9c787a2a3a4ca88816c7e6afecd5c2ddd.a1161040.png)

## Using your API key

Include the key in every request header:

```
Authorization: Bearer <JONDAX_API_KEY>
```

## Rules

- Do not include extra prefixes, suffixes, quotes, or spaces in the token value.
- Never expose the API key in client-side code.
- Store the key securely (environment variables, secrets manager, etc.).
- Rotate or regenerate keys in the client portal immediately if exposed.