# Authentication

> Use Authorization: Bearer or X-API-Key on protected API endpoints.

Source: https://fourechelon.com/docs/authentication · Machine-readable: https://fourechelon.com/openapi.json · Index: https://fourechelon.com/llms.txt

## Two accepted headers

Send your key as Authorization: Bearer, or as X-API-Key. Both are equivalent; pick one and stay consistent so your logs are readable.

- Authorization: Bearer $FOUR_ECHELON_API_KEY
- X-API-Key: $FOUR_ECHELON_API_KEY

## Failure modes

A missing, malformed, or revoked key returns 401 authentication_error. A valid key without an active subscription returns 402 payment_required — that distinction matters, because one is a credential problem and the other is a billing one.

## Partner webhooks are different

Inbound partner webhooks are authenticated by HMAC-SHA256 over the raw request body, not by API key. See partner CAD webhooks for the signature headers.