> ## Documentation Index
> Fetch the complete documentation index at: https://docs.mygigsters.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Authenticate every request with an API key pair sent over HTTP Basic authentication, plus an API version header.

The API authenticates every request with an API key pair sent with HTTP Basic authentication, plus an API version header.

## Generate an API key

In the MyGigsters dashboard, go to **Settings → API Keys** and generate a key. You receive two values:

| Value | Description |
| - | - |
| `uuid` | Your API key identifier (a UUID). Acts as the username. |
| `randomPasswordShowOnce` | Your API secret. Acts as the password. Shown only once at creation, so store it securely. If you lose it, generate a new key. |

> [!WARNING]
>
> Keep your secret safe. Never put API credentials in client-side code, mobile apps, or public repositories. Make all API calls from your server. You can delete and regenerate API keys at any time from the dashboard.

## Send credentials with every request

Base64-encode `uuid:randomPasswordShowOnce` and send it in the `Authorization` header. Also send the API version header.

```http Request headers theme={null}
Authorization: Basic {base64(uuid:randomPasswordShowOnce)}
X-API-Version: 1.2
Content-Type: application/json
```

```bash cURL theme={null}
curl https://qa-payments.mygigsters.com.au/api/v1/customer/{customer_id} \
  -u "YOUR_UUID:YOUR_SECRET" \
  -H "X-API-Version: 1.2"
```

```javascript Node.js theme={null}
const credentials = Buffer.from(`${process.env.MG_UUID}:${process.env.MG_SECRET}`).toString("base64");

const res = await fetch(`https://qa-payments.mygigsters.com.au/api/v1/customer/${customerId}`, {
  headers: {
    Authorization: `Basic ${credentials}`,
    "X-API-Version": "1.2",
  },
});
```

```python Python theme={null}
import os
import requests

res = requests.get(
    f"https://qa-payments.mygigsters.com.au/api/v1/customer/{customer_id}",
    auth=(os.environ["MG_UUID"], os.environ["MG_SECRET"]),
    headers={"X-API-Version": "1.2"},
)
```

`curl -u` and the `auth` option build the Basic header for you.

## The version header is required

Include `X-API-Version: 1.2` on every request. Supported versions are `1.1` and `1.2`.

If the header is missing or set to an unsupported version, the request is rejected with `400 Bad Request`:

```json Missing header theme={null}
{ "error": "Missing X-API-Version header. Supported versions are 1.1 and 1.2." }
```

```json Unsupported version theme={null}
{ "error": "Unsupported X-API-Version '1.3'. Supported versions are 1.1 and 1.2." }
```

## Keys are environment-specific

A key generated in the demo (QA) dashboard does not work in production, and a production key does not work in demo. See [Environments](https://docs.mygigsters.com/get-started/environments.md).

## Related

> [card] [API keys and rotation](https://docs.mygigsters.com/security/api-keys-and-rotation.md)
>
> Rotate keys with no downtime.

> [card] [Restricted keys](https://docs.mygigsters.com/security/restricted-keys.md)
>
> Give each integration only the access it needs.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.