> ## Documentation Index
> Fetch the complete documentation index at: https://docs.donate.gg/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Authenticate your requests with a `donate-api-key` header

All Developer API endpoints require authentication via an API key passed as a request header, except for [`GET /openapi`](https://www.donate.gg/api/v1/openapi) and [`GET /postman`](https://www.donate.gg/api/v1/postman), which are publicly accessible.

## API key header

Include your API key in every request using the `donate-api-key` header:

```bash theme={null}
curl https://www.donate.gg/api/v1/charities \
  -H "donate-api-key: YOUR_API_KEY"
```

<Warning>
  Never expose your API key in client-side code, public repositories, or anywhere it could be
  accessed by others. All API requests should be made server-side.
</Warning>

## Error responses

If authentication fails, the API returns one of the following errors:

| Status | Code              | Description                                                 |
| ------ | ----------------- | ----------------------------------------------------------- |
| `400`  | `MISSING_API_KEY` | The `donate-api-key` header was not included in the request |
| `403`  | `INVALID_API_KEY` | The provided API key does not match any developer account   |

**Example error response:**

```json theme={null}
{
  "error": "Missing API Key",
  "code": "MISSING_API_KEY"
}
```

## Public endpoints

The following endpoints do **not** require the `donate-api-key` header:

| Endpoint       | Description                       |
| -------------- | --------------------------------- |
| `GET /openapi` | OpenAPI 3.0.0 JSON spec           |
| `GET /postman` | Postman collection (from OpenAPI) |

## Keeping your key secure

* Store your API key in environment variables, never hardcoded
* Do not commit it to version control
* If your key is compromised, contact us at [support@donate.gg](mailto:support@donate.gg) to have it rotated

<Card title="Don't have an API key yet?" icon="key" href="/developer/getting-access">
  Apply for API access
</Card>