> ## Documentation Index
> Fetch the complete documentation index at: https://docs.printools.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Authenticate with a tenant API key or partner credentials.

PRINTOOLS supports tenant API keys and partner credentials. Choose the method that matches your integration.

## Tenant API keys

A tenant key is bound to one shop. Send the key in `X-API-Key`.

```bash theme={"dark"}
curl 'https://api.printools.io/v1/me' \
  -H "X-API-Key: ${PRINTOOLS_API_KEY}"
```

| Header                        | Requirement                                                     |
| ----------------------------- | --------------------------------------------------------------- |
| `X-API-Key`                   | Required. Your tenant API key.                                  |
| `X-PRINTOOLS-Organization-Id` | Optional. If provided, it must match the shop bound to the key. |

Do not put a tenant key in `Authorization: Bearer`. That header is used for a partner's access token.

## Partner credentials

Partner requests require all four headers:

| Header                        | Value                                           |
| ----------------------------- | ----------------------------------------------- |
| `X-API-Key`                   | Partner application client ID                   |
| `X-API-Secret`                | Partner application secret                      |
| `Authorization`               | `Bearer <access token>`, obtained through OAuth |
| `X-PRINTOOLS-Organization-Id` | An organisation the user has authorised         |

```bash theme={"dark"}
curl 'https://api.printools.io/v1/me' \
  -H "X-API-Key: ${PRINTOOLS_CLIENT_ID}" \
  -H "X-API-Secret: ${PRINTOOLS_CLIENT_SECRET}" \
  -H "Authorization: Bearer ${PRINTOOLS_ACCESS_TOKEN}" \
  -H "X-PRINTOOLS-Organization-Id: ${PRINTOOLS_ORGANIZATION_ID}"
```

Follow the [partner OAuth guide](https://app.printools.io/api/index.html#partner-auth) to obtain an access token.

## Check your credentials

[Get current account](/api/reference/get_v1_me) returns the organisation, credential, and granted scopes. It requires valid credentials but no API scope.

## Handle authentication errors

* **401:** Check the credential headers, key or token expiry, and whether credentials belong to the intended environment.
* **403:** Check the operation's required scopes and the actor's permissions.
* If you send an organisation header, use an organisation allowed by the credential.

Keep keys, secrets, and access tokens out of source control and browser code. Create and manage tenant keys in **Settings → API**.