> ## Documentation Index
> Fetch the complete documentation index at: https://docs.notvis.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Learn how to authenticate your API requests with Notvis Connect.

## API Keys

All API requests (except Push SDK endpoints) require authentication via an API key. You can create and manage API keys from the [Notvis Connect dashboard](https://notvis.com/api-keys).

API keys follow the format: `nc_live_XXXXXXXX...`

## Sending Your API Key

Include your API key in the request header using one of these methods:

<CodeGroup>
  ```bash Authorization Header (Recommended) theme={null}
  curl -X POST https://api.notvis.com/v1/emails/send \
    -H "Authorization: Bearer nc_live_your_api_key" \
    -H "Content-Type: application/json"
  ```

  ```bash X-API-Key Header theme={null}
  curl -X POST https://api.notvis.com/v1/emails/send \
    -H "X-API-Key: nc_live_your_api_key" \
    -H "Content-Type: application/json"
  ```
</CodeGroup>

## Key Security

<Warning>
  Never expose your API keys in client-side code, public repositories, or browser requests. Always make API calls from your backend server.
</Warning>

* **Keep keys secret** — treat them like passwords
* **Use environment variables** — never hardcode keys in source code
* **Rotate regularly** — revoke and regenerate keys periodically
* **Use separate keys** — create different keys for different environments (development, staging, production)

## Unauthenticated Endpoints

The following endpoints do not require an API key (designed for client-side SDKs):

* `POST /v1/push/register` — Register a push notification device
* `POST /v1/push/identify` — Link a device to an identified user

These endpoints validate the `account_id` and `app_id` internally.