> ## Documentation Index
> Fetch the complete documentation index at: https://developers.dnsradar.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Learn how to authenticate your API requests with DNSRadar

## API Key Authentication

The DNSRadar API uses API keys to authenticate requests. All API requests must include your secret API key in the request header to identify your account and authorize access.

<Warning>
  Your API keys carry significant privileges. Keep them secure and never share them in publicly accessible areas such as GitHub, client-side code, or public repositories.
</Warning>

## Getting Your API Key

You can create and manage your API keys from the [DNSRadar Dashboard](https://dashboard.dnsradar.dev):

1. Log in to your account
2. Navigate to Settings → API Keys
3. Click "Generate New API Key"
4. Copy and securely store your key

<Info>
  API keys have the prefix `sk_` followed by a unique identifier.
</Info>

## Making Authenticated Requests

Include your API key in the `X-Api-Key` header with every request:

<CodeGroup>
  ```bash cURL theme={null}
  curl https://api.dnsradar.dev/monitors \
    -H "X-Api-Key: sk_your_api_key_here"
  ```

  ```javascript JavaScript theme={null}
  const response = await fetch('https://api.dnsradar.dev/monitors', {
    headers: {
      'X-Api-Key': 'sk_your_api_key_here'
    }
  });
  ```

  ```python Python theme={null}
  import requests

  headers = {
      'X-Api-Key': 'sk_your_api_key_here'
  }

  response = requests.get('https://api.dnsradar.dev/monitors', headers=headers)
  ```

  ```php PHP theme={null}
  $ch = curl_init('https://api.dnsradar.dev/monitors');
  curl_setopt($ch, CURLOPT_HTTPHEADER, [
      'X-Api-Key: sk_your_api_key_here'
  ]);
  $response = curl_exec($ch);
  ```
</CodeGroup>

## Authentication Errors

If authentication fails, you'll receive one of the following error responses:

| Status Code | Error        | Description                                         |
| ----------- | ------------ | --------------------------------------------------- |
| `401`       | Unauthorized | No API key was provided in the request header       |
| `403`       | Forbidden    | The API key provided is invalid or has been revoked |

## Best Practices

<AccordionGroup>
  <Accordion title="Rotate Your Keys Regularly">
    Generate new API keys periodically and revoke old ones to minimize security risks.
  </Accordion>

  <Accordion title="Use Environment Variables">
    Store API keys in environment variables rather than hardcoding them in your application code.
  </Accordion>

  <Accordion title="Monitor API Key Usage">
    Track which keys are being used and where to quickly identify and respond to potential security issues.
  </Accordion>

  <Accordion title="Use HTTPS Only">
    Always make API requests over HTTPS to prevent your API key from being intercepted.
  </Accordion>
</AccordionGroup>