> ## Documentation Index
> Fetch the complete documentation index at: https://docs.bidengine.app/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Authenticate requests to the BidEngine Project API.

The BidEngine Project API lets you read and create projects programmatically. Requests are authenticated with two credentials sent as headers.

## Credentials

Generate both from your settings page in the BidEngine app.

| Header          | Credential         | Purpose                                 |
| --------------- | ------------------ | --------------------------------------- |
| `apikey`        | API key            | Identifies your application.            |
| `Authorization` | `Bearer <API key>` | Carries the same key as a bearer token. |
| `X-API-Secret`  | API secret         | Scopes the request to your company.     |

<Warning>
  Your API secret scopes every request to your company's data. Keep it server-side. Do not ship it in a browser bundle, a mobile app, or any client you don't control — anyone holding it can read and write your projects.
</Warning>

## Base URL

```text theme={null}
https://fqtlkdttexdbenjqgdzg.supabase.co
```

## A minimal authenticated request

<CodeGroup>
  ```bash cURL theme={null}
  curl -X GET "https://fqtlkdttexdbenjqgdzg.supabase.co/rest/v1/project?select=*" \
    -H "apikey: YOUR_API_KEY" \
    -H "Authorization: Bearer YOUR_API_KEY" \
    -H "X-API-Secret: YOUR_API_SECRET"
  ```

  ```javascript JavaScript theme={null}
  const res = await fetch(
    'https://fqtlkdttexdbenjqgdzg.supabase.co/rest/v1/project?select=*',
    {
      headers: {
        apikey: process.env.BIDENGINE_API_KEY,
        Authorization: `Bearer ${process.env.BIDENGINE_API_KEY}`,
        'X-API-Secret': process.env.BIDENGINE_API_SECRET,
      },
    }
  );

  const projects = await res.json();
  ```

  ```python Python theme={null}
  import os
  import requests

  response = requests.get(
      "https://fqtlkdttexdbenjqgdzg.supabase.co/rest/v1/project",
      params={"select": "*"},
      headers={
          "apikey": os.environ["BIDENGINE_API_KEY"],
          "Authorization": f"Bearer {os.environ['BIDENGINE_API_KEY']}",
          "X-API-Secret": os.environ["BIDENGINE_API_SECRET"],
      },
  )

  print(response.json())
  ```
</CodeGroup>

<Tip>
  Read the credentials from environment variables rather than hardcoding them, as in the examples above. It keeps them out of your version control history.
</Tip>

## Troubleshooting

<AccordionGroup>
  <Accordion title="401 Unauthorized">
    The `apikey` header is missing or the key is wrong. Confirm you sent the key in both `apikey` and `Authorization: Bearer`.
  </Accordion>

  <Accordion title="Empty result set instead of an error">
    A valid key with a missing or incorrect `X-API-Secret` can return zero rows rather than an explicit error, because the request isn't scoped to your company. If you expect projects and get `[]`, check `X-API-Secret` first.
  </Accordion>
</AccordionGroup>

## Next steps

<Card title="Projects" icon="folder" href="/api-reference/projects">
  Read and create projects.
</Card>