# Authentication

Every public API request must include the credentials issued to the calling Platform or Advertiser. Onward uses two headers together:

Both currently published operations use these credentials: [read active quest chains](/docs/api-reference/quest-chain-api#get-active-quest-chains-for-the-user) and [complete account linking](/docs/api-reference/users-api#complete-oauth-account-linking).

| Header | Required | Purpose |
| --- | --- | --- |
| `X-API-Key` | Yes | Public identifier of the integration credential. |
| `X-API-Secret` | Yes | Private secret used to authenticate the request. |

```http
GET /v1/quest-chains/active/platform-user-123 HTTP/1.1
Host: api.onwardinc.net
X-API-Key: pk_platform_live_abc123
X-API-Secret: sk_platform_live_xyz789
Accept: application/json
```

:::warning
Call Onward only from your backend. Never embed `X-API-Secret` in browser, mobile, or other client-distributed code.
:::

## Credential scope

Credentials identify both the integration and its provider type. A Platform credential cannot call Advertiser-only operations, and each credential must have permission for the requested operation.

Authentication and authorization failures use these HTTP statuses:

- `401 Unauthorized` — headers are missing or the credential pair is invalid.
- `403 Forbidden` — the credential is inactive, has the wrong provider type, or lacks the required permission.

## Recommended handling

- Store credentials in a secret manager or protected environment variables.
- Use separate credentials for development and production.
- Rotate credentials periodically and immediately after suspected exposure.
- Do not log `X-API-Secret` or include it in error reports.
- Use HTTPS for every request.
- Treat repeated `401` and `403` responses as a configuration problem rather than an automatic retry condition.