> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cheqpay.mx/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Secure your API requests with API keys

## API Authentication

All API requests require authentication using your API credentials in the request headers.

### Using Your API Credentials

Authenticate every request with your API key in the `x-api-key` header. You can also include your merchant ID in the `x-merchant-id` header:

```bash theme={null}
x-api-key: YOUR_API_KEY
x-merchant-id: YOUR_MERCHANT_ID
```

<Note>
  `x-merchant-id` is optional.
</Note>

### Example Request

```bash theme={null}
curl -X POST https://api.sandbox.cheqpay.mx/pos/v2/payment-orders \
  -H "x-api-key: YOUR_API_KEY" \
  -H "x-merchant-id: YOUR_MERCHANT_ID" \
  -H "Content-Type: application/json" \
  -d '{
    "externalId": "order-123",
    "amount": 10000,
    "currency": "MXN"
  }'
```

<Warning>
  Keep your API keys secure. Never share them publicly or commit them to version control.
</Warning>

## Best Practices

### Store Keys Securely

Always use environment variables to store your API credentials:

```javascript theme={null}
// ✅ Good - Use environment variables
const apiKey = process.env.CHEQPAY_API_KEY;

// ❌ Bad - Never hardcode
const apiKey = 'sk_live_abc123...';
```

### Use Different Keys for Each Environment

You'll receive separate API keys for:

* **Sandbox** - For testing and development
* **Production** - For live payments

Never use production keys in your development environment.

### Rotate Keys Regularly

For security, periodically rotate your API keys:

1. Generate a new key in your dashboard
2. Update your application with the new key
3. Test thoroughly
4. Deactivate the old key

## Getting Your API Keys

1. Sign up for a Cheqpay account
2. Navigate to your dashboard
3. Go to Settings → API Keys
4. Copy your keys for sandbox and production

<Note>
  Contact our support team at [support@cheqpay.mx](mailto:support@cheqpay.mx) if you need help setting up your API keys.
</Note>