> ## Documentation Index
> Fetch the complete documentation index at: https://trophy-ci-i18n-auto-translations.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Integrate securely with the Admin API using account-level admin API keys transmitted in the `X-API-KEY` header.

<Tip>
  For client-side or end-user access to the Application API, create
  [application API keys](/api-reference/authentication) scoped to a single user
  instead.
</Tip>

<h2 id="admin-api-keys">
  Admin API keys
</h2>

Admin API keys are account-level credentials with broad permissions. Use them to authenticate requests to the Admin API, and optionally to the [Application API](/api-reference/authentication) from trusted server-side environments.

Every account can create a maximum of 3 admin API keys from the [integration page](https://app.trophy.so/integration) of the Trophy dashboard.

Trophy keeps track of and displays when each admin API key in your account was created and when it was last used so you can easily keep track of usage.

<Frame>
  <img height="200" noZoom src="https://mintcdn.com/trophy-ci-i18n-auto-translations/kq20NZCpkjuLyTvG/assets/api/authentication/api_keys.png?fit=max&auto=format&n=kq20NZCpkjuLyTvG&q=85&s=756e3b146aed6ce01c917dd913b6e500" data-path="assets/api/authentication/api_keys.png" />
</Frame>

<Warning>
  Admin API keys can access any user and any admin operation in your account.
  Never expose them in client-side code, mobile apps, or public repositories.
</Warning>

<h3 id="anatomy-of-an-admin-api-key">
  Anatomy of an admin API key
</h3>

Each admin API key is made up of 2 parts separated by a period:

```bash theme={null}
{prefix}.{body}
```

* The *prefix* is the first 8 characters. It's readable and will always stay the same so it's easily recognisable.
* The *body* is the secret part, and is only shown to you once when you create the key.

<Note>
  When using the API, both parts of your admin API key must be sent in the
  `X-API-KEY` header.
</Note>

<h3 id="authenticating-requests">
  Authenticating requests
</h3>

When making requests to the Admin API, include both parts of your admin API key in the `X-API-KEY` header, or pass it when initializing an SDK client:

<CodeGroup>
  ```bash cURL theme={null}
  curl https://admin.trophy.so/v1/metrics \
       -H "X-API-KEY: YOUR_API_KEY"
  ```

  ```typescript Node theme={null}
  import { TrophyApiClient } from "@trophyso/node";

  const trophy = new TrophyApiClient({
    apiKey: "YOUR_API_KEY",
  });
  ```

  ```python Python theme={null}
  from trophy import TrophyApi

  client = TrophyApi(
      api_key="YOUR_API_KEY",
  )
  ```

  ```php PHP theme={null}
  use Trophy\TrophyClient;

  $trophy = new TrophyClient("YOUR_API_KEY");
  ```

  ```java Java theme={null}
  TrophyApiClient client = TrophyApiClient.builder()
      .apiKey("YOUR_API_KEY")
      .build();
  ```

  ```go Go theme={null}
  import (
    trophyclient "github.com/trophyso/trophy-go/client"
    "github.com/trophyso/trophy-go/option"
  )

  client := trophyclient.NewClient(
    option.WithApiKey("YOUR_API_KEY"),
  )
  ```

  ```csharp C# theme={null}
  var trophy = new TrophyApiClient(
      apiKey: "YOUR_API_KEY"
  );
  ```

  ```ruby Ruby theme={null}
  client = Trophy::Client.new(
    api_key: "YOUR_API_KEY"
  )
  ```
</CodeGroup>

The same key authenticates Application API requests when you use an admin API key from a server-side environment:

<CodeGroup>
  ```bash cURL theme={null}
  curl https://api.trophy.so/v1/users/user_123/metrics/<key> \
       -H "X-API-KEY: YOUR_API_KEY"
  ```

  ```typescript Node theme={null}
  import { TrophyApiClient } from "@trophyso/node";

  const trophy = new TrophyApiClient({
    apiKey: "YOUR_API_KEY",
  });
  ```

  ```python Python theme={null}
  from trophy import TrophyApi

  client = TrophyApi(
      api_key="YOUR_API_KEY",
  )
  ```

  ```php PHP theme={null}
  use Trophy\TrophyClient;

  $trophy = new TrophyClient("YOUR_API_KEY");
  ```

  ```java Java theme={null}
  TrophyApiClient client = TrophyApiClient.builder()
      .apiKey("YOUR_API_KEY")
      .build();
  ```

  ```go Go theme={null}
  import (
    trophyclient "github.com/trophyso/trophy-go/client"
    "github.com/trophyso/trophy-go/option"
  )

  client := trophyclient.NewClient(
    option.WithApiKey("YOUR_API_KEY"),
  )
  ```

  ```csharp C# theme={null}
  var trophy = new TrophyApiClient(
      apiKey: "YOUR_API_KEY"
  );
  ```

  ```ruby Ruby theme={null}
  client = Trophy::Client.new(
    api_key: "YOUR_API_KEY"
  )
  ```
</CodeGroup>

If you do not pass an API key, or your API key is invalid, you'll receive a `401` response code.

<h2 id="managing-admin-api-keys">
  Managing admin API keys
</h2>

There are a few different operations you can perform on admin API keys from within your Trophy dashboard to manage your integration.

<Frame>
  <img height="200" noZoom src="https://mintcdn.com/trophy-ci-i18n-auto-translations/kq20NZCpkjuLyTvG/assets/api/authentication/api_key_options.png?fit=max&auto=format&n=kq20NZCpkjuLyTvG&q=85&s=5eb712ee199bdf8e76352b24b8ae1c83" data-path="assets/api/authentication/api_key_options.png" />
</Frame>

<h3 id="rotating-keys">
  Rotating keys
</h3>

Admin API keys can be rotated if you want to change them for any reason. At the point of rotation, the original API key will no longer function and any requests still using it will begin receiving `401` responses immediately.

<Note>
  Note that when rotating keys, both the prefix and the body will change.
</Note>

<h3 id="revoking-keys">
  Revoking keys
</h3>

Admin API keys can also be revoked entirely at which point they become *Inactive*. At the point of revocation, the API key will no longer function and any requests still using it will begin receiving `401` responses immediately.

Once revoked you can re-activate the API key at any time.

<Note>
  Neither the prefix or the body of the key change when revoked or re-activated.
</Note>

<h3 id="deleting-api-keys">
  Deleting API keys
</h3>

If you're 100% sure you no longer need an admin API key, they can be deleted.

<Error>Once API keys are deleted, they cannot be recovered.</Error>

<h2 id="get-support">
  Get Support
</h2>

Want to get in touch with the Trophy team? Reach out to us via [email](mailto:support@trophy.so). We're here to help!