## Server-to-server authentication

The B2B API uses the `X-API-Key` header. The key determines the Tenant and environment; sending another organization’s identifier cannot change that scope. API credentials are separate from Portal login and browser session tokens.

```http
X-API-Key: REPLACE_ON_YOUR_SERVER
```

## Protect the secret

- Store the key in a secrets manager or protected server configuration.
- Never include it in public JavaScript, URLs, distributed applications, repositories or support tickets.
- Log only necessary operational data. Redact headers and personal data.
- Separate credentials and configuration by environment. Grant only the permissions your integration needs.

If you suspect exposure, stop using the compromised key, coordinate revocation and replacement with the environment owner and confirm that consumers have switched to the new credential. Rotation should not require changing the verified person’s application.

## Diagnose access errors

`401` can mean a missing, invalid, revoked or environment-incompatible key. Depending on the operation, `403` can also indicate a disabled environment, insufficient permissions or an unauthorized IP. Do not retry these failures indefinitely.

Downloads require separate authorization; access to a transaction does not automatically grant access to its files. See [documents and evidence](/en/developers/kyc/documents-and-evidence) and the error codes in the [reference](/en/developers/kyc/reference).