---
title: Authentication
description: "The Slapshot API authenticates requests with an API key. Include your key in the `x-api-key` header of every request. Requests without a valid key are rejected. HEADER`x-api-key: YOUR_API_KEY` ## Getting an API key API keys are issued by Slapshot. If…"
url: "https://slapshot.ai/docs/authentication/"
updated: "2026-10-31"
category: API
---

# Authentication

The Slapshot API authenticates requests with an API key. Include your key in the `x-api-key` header of every request. Requests without a valid key are rejected.

 HEADER`x-api-key: YOUR_API_KEY`

## Getting an API key

API keys are issued by Slapshot. If you don't have one yet, contact [support@slapshot.ai](mailto:support@slapshot.ai).

## Making an authenticated request

```bash
export SLAPSHOT_API_KEY="your_api_key"

curl "https://autopilot.slapshot.ai/api/jobs" 
  -H "x-api-key: $SLAPSHOT_API_KEY"
```

```python
import os
import requests

session = requests.Session()
session.headers.update({"x-api-key": os.environ["SLAPSHOT_API_KEY"]})

resp = session.get("https://autopilot.slapshot.ai/api/jobs")
resp.raise_for_status()
print(resp.json()["count"], "jobs")
```

Using a `requests.Session` sends the header automatically on every call and reuses the connection.

## Keeping your key secure

- Treat your API key like a password. Anyone with the key can create and cancel jobs on your account.
- Load the key from an environment variable or a secrets manager. Don't hard-code it or commit it to source control.
- Only call the API from server-side code. Never ship the key in a browser, mobile app or DCC plugin that end users can inspect.
- If you think a key has been exposed, contact [support@slapshot.ai](mailto:support@slapshot.ai) to have it replaced.