> ## Documentation Index
> Fetch the complete documentation index at: https://storeinspect.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Authenticate requests with a StoreInspect API key or an approved StoreInspect OAuth client.

StoreInspect API requests use Bearer authentication.

```bash theme={null}
curl https://storeinspect.com/api/v1/usage \
  -H "Authorization: Bearer $STOREINSPECT_API_KEY"
```

## API keys

API keys are created from the StoreInspect dashboard by paid-plan accounts with API access enabled.

Keep keys server-side. Do not put them in browser code, mobile apps, public repos, client logs, or query strings.

## StoreInspect OAuth integrations

StoreInspect-managed integrations such as the Google Sheets add-on use OAuth
instead of asking users to paste API keys. OAuth access tokens use the same
Bearer header, endpoint scopes, paid-plan checks, quotas, and contact-credit
ledger as API keys.

The API OAuth resource is:

```text theme={null}
https://storeinspect.com/api/v1
```

OAuth client registration and secrets are managed by StoreInspect. API
developers building independent server-side integrations should continue to
use dashboard-created API keys unless StoreInspect has approved an OAuth client
for their integration.

## Request IDs

Every API response includes an `X-Request-Id` header and a `request_id` field in the JSON body.

Include the request ID when contacting support.

```text theme={null}
X-Request-Id: req_abc123
```

## Key safety

* Store keys in environment variables or a secret manager.
* Use separate keys for separate integrations.
* Rotate a key immediately if it may have been exposed.
* Never log raw API keys.