{% callout type="info" %}
A **Tenant ID** is required for API calls. These are issued manually upon request, please contact us if you have not yet been issued one.
{% /callout %}

When it comes to interacting with APIs, authentication is a critical step to ensure secure communication between your application and the API service. API authentication is performed via HTTP Basic Auth, which involves including your API key in the HTTP request headers. This method verifies your identity and grants you access to the API's resources, ensuring that only authorized users can make requests.

TrueVault API uses `API keys` to authenticate requests.

### To retrieve your API key from TrueVault, follow these steps:

1.  **Sign in**: Navigate to [https://dashboard.truevault.com.au/](https://dashboard.truevault.com.au/) and sign in with your credentials. (Use [https://dashboard.sandbox.truevault.com.au/](https://dashboard.sandbox.truevault.com.au/) for sandbox access)

2.  **User Settings**: Once logged in, click on `Account` in the upper right corner.

3.  **API Tokens Tab**: Within the user settings, find the "API Tokens" tab. Click on it to access settings related to integrations and tools.

4.  **Locate API Key**: In the API Tokens tab, you should find your API keys listed. Click on `Generate API Token` if a new token is needed

Add headers to an HTTP request
------------------------------

When issuing an HTTP request to TrueVault, each request must contain an `Api-Key` header that specifies a valid API key and must be encoded as JSON with the `Content-Type: application/json` header.

Note this example data is incomplete, referencing the [Identity Request API Endpoint](/rest-api-reference/identity/request-a-new-trueidentity).

```shell
curl -s -X POST "https://api.truevault.com.au/api/v1/identity/request" \
   -H "Content-Type: application/json" \
   -H "Authorization: YOUR_API_KEY" \
   -H “X-Correlation-Id: req-64b4a7e123456” \
   -H “X-Tenant-Id: 048c2a1c-0881-4dcc-bfca-ccccccccc51”
   -H “X-Request-Timestamp: 1754261500”
   -d '{
         "first_name":  "TrueVault",
         "last_name": "APIDoc",
         "email": “hello@truevault.com.au”,
         "phone": "432567987",
         "phone_country_code": "61"
      }
```

{% callout type="warning" %}
Your API keys grant significant access, so it’s crucial to keep them safe! Avoid sharing your secret API keys in public places like GitHub, client-side code, and similar locations.
{% /callout %}
{% callout type="error" %}
API requests without authentication will fail.
{% /callout %}