> ## Documentation Index
> Fetch the complete documentation index at: https://docs.payments.bob.company/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Every route requires a Bearer Token in the Authorization header.

Bob Payments uses a Bearer Token to authenticate every request. The key is sent in the `Authorization` header:

```
Authorization: Bearer sk_test_your_key_here
```

## Key types

| Type       | Prefix      | Use                     |
| ---------- | ----------- | ----------------------- |
| Sandbox    | `sk_test_*` | Testing and development |
| Production | `sk_live_*` | Real environment        |

## Examples

<CodeGroup>
  ```bash cURL theme={"system"}
  curl https://api.payments.bob.company/api/store \
    -H "Authorization: Bearer sk_test_your_key"
  ```

  ```javascript JavaScript theme={"system"}
  const response = await fetch('https://api.payments.bob.company/api/store', {
    headers: {
      'Authorization': 'Bearer sk_test_your_key',
      'Content-Type': 'application/json'
    }
  });

  const data = await response.json();
  ```

  ```python Python theme={"system"}
  import requests

  response = requests.get(
      'https://api.payments.bob.company/api/store',
      headers={'Authorization': 'Bearer sk_test_your_key'}
  )

  data = response.json()
  ```
</CodeGroup>

## Generating your API key

<Steps>
  <Step title="Open the Dashboard">
    Sign in at [app.payments.bob.company](https://app.payments.bob.company) and select your project.
  </Step>

  <Step title="Open the API Keys page">
    In the side menu, click **API keys**.
  </Step>

  <Step title="Create a new key">
    Click **New key**, give it a descriptive name (e.g. `backend-production`), and confirm.
  </Step>

  <Step title="Copy and store it securely">
    The key is shown **only once**. Save it in a secrets manager or an environment variable.
  </Step>
</Steps>

<Tip>
  Use environment variables (`process.env.BOB_API_KEY`) so you never expose the key in your code.
</Tip>

<Warning>
  If a key leaks, revoke it immediately from the Dashboard and generate a new one.
</Warning>

## Authentication errors

| HTTP  | Description                                      |
| ----- | ------------------------------------------------ |
| `401` | Token missing or invalid                         |
| `403` | Valid token, but no permission for this resource |

## Next steps

<CardGroup cols={2}>
  <Card title="Test in the sandbox" icon="flask" href="/en/pages/sandbox">
    Use the `sk_test_` key to run the full flow without real money.
  </Card>

  <Card title="Errors" icon="triangle-exclamation" href="/en/pages/errors">
    See what to do with each status and error code.
  </Card>
</CardGroup>