# Authentication

> Create an API key and send it in the x-api-key header on every request.

Source: https://docs.csquaregrc.com/api/authentication


## Create an API key

1. In the app, open **Settings > API keys**.
2. Choose **Create key**, give it a name and an optional expiry date.
3. Copy the key. It is shown once; cSquare stores only a hash of it.

Keys belong to your organization, not to a person, so they keep working when people leave. Rotate them by creating a new key and revoking the old one.

## Send the key

Pass the key in the `x-api-key` header:

```bash
curl https://YOUR_API_BASE/health \
  -H "x-api-key: $CSQUARE_API_KEY"
```

A healthy response lists your tenant and the endpoints available to it:

```json
{
  "status": "ready",
  "tenant": "Acme Platform",
  "endpoints": ["GET  /sub-orgs", "POST /sub-orgs", "POST /compliance/check"]
}
```

## Failure cases

| Status | Meaning |
| --- | --- |
| 401 `Missing x-api-key header` | The header was not sent. |
| 401 `Invalid API key or no platform tenant configured` | The key is wrong, revoked, expired, or your organization is not set up as a platform tenant. |

## Keep keys safe

- Never put an API key in browser or mobile code. Call the API from your server.
- Use one key per environment so you can revoke one without affecting the others.

## Get help from AI

Click **Copy page for AI** at the top of any API page and paste it into your assistant with a prompt like:

```text
Using the cSquare GRC API docs I pasted, write a <language> function that calls the health endpoint with my API key from an environment variable and handles both 401 errors.
```