> ## Documentation Index > Fetch the complete documentation index at: https://developers.tapfiliate.com/llms.txt > Use this file to discover all available pages before exploring further. # Authentication > Authenticate API requests with your API key. Every request to the REST API carries your API key in the `X-Api-Key` header: ```bash theme={null} curl https://api.tapfiliate.com/1.6/conversions/ \ -H "X-Api-Key: YOUR_API_KEY" ``` Send the key exactly as it is shown in your account, without quotes or extra spaces. All requests must use HTTPS. ## Where to find your key Your API key is in your [profile settings](https://app.tapfiliate.com/a/profile/) in the Tapfiliate dashboard. The [help center](https://support.tapfiliate.com/en/articles/12793297-how-to-find-account-id-and-api-key) shows the exact place. The key belongs to your user in one advertiser account and acts with your permissions there. It is not scoped to a single program or to read-only access. ## Keep it secret Your API key can approve commissions and change affiliate data. Use it only from your server. * Do not put it in browser code. For tracking from the browser use [tapfiliate.js](/tracking/javascript), which needs only your public account ID. * Do not commit it to a repository or paste it into tickets and chats. * If the key has leaked, regenerate it in your profile settings. The old key stops working immediately, including in webhooks and integrations that use it. ## Errors | Status | Meaning | | - | - | | `401` | The key is missing or wrong. A wrong key returns `{"message": "Authentication Failed.", "code": 401}`. | | `403` | The key is valid, but your user has no API access. Ask the account owner to grant the API access permission, or contact support. | ## Connecting AI assistants The [MCP server](/ai/mcp) does not use your API key. It signs you in with OAuth, so you never paste the key into an AI tool. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.