> ## Documentation Index
> Fetch the complete documentation index at: https://docs.scanova.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Learn how to authenticate with the Scanova API using API keys

## Overview

The **Scanova API** uses **API key authentication** to secure all endpoints.\
You must include your **API key** in every request to successfully access the API.\
Each request without valid authentication will be rejected with a `401 Unauthorized` error.

## API Key Authentication

All requests must include your API key in the `Authorization` header — **without any prefix**.

### Header Format

```bash theme={null}
Authorization: YOUR_API_KEY
```

<Note>
  All API endpoints require authentication using an API key. The API key must be passed directly in the `Authorization` header without any prefix.
</Note>

### Example Request

```bash theme={null}
curl -X POST "https://management.scanova.io/qr/" \
  -H "Authorization: sk_live_1234567890abcdef" \
  -H "Content-Type: application/json" \
  -d '{
    "category": "1",
    "info": "{\"type\":\"url\",\"data\":{\"url\":\"https://example.com\"}}",
    "qr_type": "dy",
    "name": "My QR Code"
  }'
```

## Obtaining Your API Key

### Step 1: Log in to Scanova

1. Visit [https://app.scanova.io](https://app.scanova.io)
2. Log in to your account

### Step 2: Navigate to API Settings

1. Go to your dashboard
2. Go to **Settings** and click on the **API** tab

### Step 3: Create an API Key

1. Click **Create New API Key**
2. Select a key type:
   * **Live API Key**: For production use
   * **Sandbox API Key**: For testing and development
3. Give your key a descriptive name
4. Click **Generate Key**

### Step 4: Copy and Store Your Key

Best practices:

* Store keys as **environment variables**
* Never commit API keys to source control
* Use a **secure secrets manager** (like AWS Secrets Manager or Vault)

## API Key Limits

| Plan       | Live API Keys | Sandbox API Keys |
| ---------- | ------------- | ---------------- |
| Enterprise | 2             | 2                |

## Environment Variables

Use environment variables to securely manage API keys in your project

Example `.env` File

```bash theme={null}
# .env
SCANOVA_API_KEY=sk_live_your_api_key_here
SCANOVA_BASE_URL=https://management.scanova.io
```

### Node.js Example

```javascript theme={null}
// Node.js example
const apiKey = process.env.SCANOVA_API_KEY;
const baseUrl = process.env.SCANOVA_BASE_URL;

const response = await fetch(`${baseUrl}/qr/`, {
  method: 'POST',
  headers: {
    'Authorization': apiKey,
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({
    category: '1',
    info: '{"type":"url","data":{"url":"https://example.com"}}',
    qr_type: 'dy',
    name: 'My QR Code'
  })
});
```

### Python Example

```python theme={null}
# Python example
import os
import requests

api_key = os.getenv('SCANOVA_API_KEY')
base_url = os.getenv('SCANOVA_BASE_URL', 'https://management.scanova.io')

headers = {
    'Authorization': api_key,
    'Content-Type': 'application/json'
}

data = {
    'category': '1',
    'info': '{"type":"url","data":{"url":"https://example.com"}}',
    'qr_type': 'dy',
    'name': 'My QR Code'
}

response = requests.post(f'{base_url}/qr/', headers=headers, json=data)
```

## Base URLs

Use the correct base URL depending on your environment:

* **Production**: `https://management.scanova.io`
* **Sandbox**: `https://sandbox-management.scanova.io`

## Error Responses

### Invalid API Key

```json theme={null}
{
  "error": "unauthorized",
  "message": "Invalid API key provided"
}
```

**HTTP Status**: `401 Unauthorized`

### Missing API Key

```json theme={null}
{
  "error": "unauthorized",
  "message": "API key is required"
}
```

**HTTP Status**: `401 Unauthorized`

### Rate Limit Exceeded

```json theme={null}
{
  "error": "rate_limit_exceeded",
  "message": "Rate limit exceeded. Please try again later."
}
```

**HTTP Status**: `429 Too Many Requests`

## Security Best Practices

<Warning>
  Follow these guidelines to keep your API keys and data secure.
</Warning>

### 1. Keep Your API Keys Safe

* Never expose keys in frontend code
* Avoid committing keys to Git or public repos
* Store them in environment variables or secure storage
* Rotate keys regularly

### 2. Always Use HTTPS

The Scanova API only supports secure connections. Avoid plain HTTP

### 3. Validate Input

* Validate and sanitize all input before making requests
* Prevent injection attacks by enforcing proper data formats

### 4. Handle Errors Gracefully

* Log errors safely (avoid exposing keys)
* Show meaningful messages to end users

### 5. Monitor Usage

* Track API usage and costs
* Set alerts for abnormal behavior
* Review and revoke unused keys

## Testing Your Authentication

You can test your API key authentication using the following endpoint:

```bash theme={null}
curl -X GET "https://management.scanova.io/auth/stats/" \
  -H "Authorization: YOUR_API_KEY"
```

A successful response indicates your API key is valid:

```json theme={null}
{
  "total_qr_count": 150,
  "total_scan_count": 2500,
  "active_qr_count": 120,
  "inactive_qr_count": 30
}
```

## Need Help?

If you're having trouble with authentication:

1. **Check your API key**: Ensure it's correctly copied
2. **Verify  header format**: Make sure you're using `Authorization: YOUR_API_KEY` (without any prefix)
3. **Check your plan**: Ensure your account include API access
4. **Contact support**: [Scanova Support Center](https://support.scanova.io) or email [**support@scanova.io**](mailto:support@scanova.io)