# Authentication

Every request except /health/api carries the client key in the X-Entity-Key header.

We issue the key when you are onboarded. We store only its hash (SHA-256), so a lost key cannot be recovered — only reissued.

```bash
curl https://merchant.dbdlobby.com/products \
  -H "X-Entity-Key: YOUR_ENTITY_KEY"
```

> [!WARNING]
> The API is meant to be called from your server. Never embed the key in browser or mobile code: anyone holding it can spend your balance.

## Authorization errors

| Code | message | Cause |
|---|---|---|
| 401 | `Missing X-Entity-Key header` | The header is missing or empty. |
| 401 | `Invalid X-Entity-Key header` | The value is longer than 128 characters. |
| 403 | `Invalid entity key` | No such key. |
| 403 | `API access disabled for this client` | API access is disabled for the client. Contact us. |

The sandbox (`/sandbox/*`) accepts the same key — you don't need a separate test key.