# Authentication

Send your API key as a Bearer token with every request.

```http
Authorization: Bearer $AREX_API_KEY
```

- `Authorization` (string): Required. Bearer followed by your API key.

- `X-Request-Id` (string): Optional. Your own request id: 1–128 letters, digits, dots, underscores or hyphens.

## Keep your key secret

The full key is shown once, when you create it. Keep it on your server or in your local environment, never in browser code or a repository. If it leaks, revoke it in API Keys and create a new one.