> ## Documentation Index
> Fetch the complete documentation index at: https://docs.heffl.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Authenticate API v2 requests with API keys

# Authentication

API v2 uses the same API key authentication as v1. Every request must include a valid key in the `x-api-key` header.

## API keys

Create and manage keys in **Settings → Developer** in the Heffl app, or at [app.heffl.com/settings/developers](https://app.heffl.com/settings/developers).

Each key is scoped to a team and acts on behalf of the user who created it.

## Request header

```bash theme={null}
curl https://api.heffl.com/api/v2/contacts \
  -H "x-api-key: YOUR_API_KEY" \
  -H "Content-Type: application/json"
```

## Unauthorized requests

Missing or invalid keys return `401`:

```json theme={null}
{
  "error": {
    "code": "UNAUTHORIZED",
    "message": "API key required. Include 'x-api-key' header."
  }
}
```

## Rate limiting

API v2 shares the same rate limit as v1: **60 requests per minute** per API key. Exceeding the limit returns `429` with `RateLimit-*` headers.

## Permissions

The API key inherits the creating user's permissions. If the user cannot create, update, or delete contacts in the app, the API will return `403 Forbidden`.