> ## Documentation Index
> Fetch the complete documentation index at: https://xchangeapi.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Start building awesome documentation in minutes

xChangeApi uses your account's API keys to authenticate API requests, and if you don't include a key or if the key is incorrect or outdated, an invalid request or authentication error will be raised.

The [Developers Dashboard](https://xchangeapi.com/profile) can be used to create, reveal, and revoke secret API keys.

<Note>
  It's important to safeguard your keys.
</Note>

Your secret API key has the ability to perform any API call for your account.
Here are some best practices to follow to ensure your keys are secure:

* Only give access to those who require it.
* Keep the key out of any version control system you may use.
* Use a password manager or secrets management service to control key access.
* Avoid embedding the secret API key in mobile applications or other locations where it can be accessed.

## Create a new API key

To create a new API key in the Dashboard:

1. Open the [Keys](https://xchangeapi.com/profile/keys) page.
2. Click New Key.
3. Enter a name in Key name (or choose the one proposed by system).
4. Click Generate Key.

## Reveal an API key

To ensure security, the API key is displayed once. It's important to store the key in a safe location to avoid losing it. If the key is lost, it can be revoked and a new key can be generated.

## Revoke an API key

If your secret key has been compromised, the key should be revoked to prevent any unauthorized API requests. To generate a new key and revoke the old API secret key:

1. Open the [Keys](https://xchangeapi.com/profile/keys) page.
2. Click the three dots icon next to the API key and choose the "Revoke" option.
3. Enter the API key name in the text input field
4. Click Revoke Key

## Using your API key

When making API requests to our API, you can provide your API key in one of two ways:

### API key as a header

Include the API key in the request header:

```http theme={null}
GET /api/v1/endpoint HTTP/1.1
Host: api.xchangeapi.com
api-key: your_api_key_here
```

### API key as a query parameter

Alternatively, you can include the API key as a query parameter:

```http theme={null}
GET /api/v1/endpoint?api-key=your_api_key_here HTTP/1.1
Host: api.xchangeapi.com
```

Either method is acceptable, but using the header approach is recommended for security reasons, especially for POST requests, as query parameters may be logged in server access logs.