> ## Documentation Index
> Fetch the complete documentation index at: https://docs.scanova.io/llms.txt
> Use this file to discover all available pages before exploring further.

# API Authentication

> How to authenticate server-side Conversion Tracking API requests using site-scoped API keys.

Server event endpoints (`POST /server-events` and `POST /server-events/batch`) require an API key. Browser events (`POST /ct`) are public and do not require authentication — they are validated by domain instead.

## API key header

Include your key in every server event request:

```http theme={null}
POST /server-events HTTP/1.1
Host: track.scanova.io
Content-Type: application/json
X-API-Key: YOUR_SITE_API_KEY
```

## Key scope

API keys are **site-scoped**. A key generated for Site A cannot be used to send events for Site B.

The `site_id` in your request body must match the site that issued the key. A mismatch returns `403 Forbidden`.

## Generating a key

Keys are created in the dashboard:

1. Go to **Integrations → Conversion Tracking**
2. Open your tracking site
3. Click the **API Keys** tab
4. Click **Generate API Key**

Full instructions: [Generate an API Key](/conversion-tracking/server/generate-api-key-dashboard)

## Security rules

* **Never include your API key in frontend/browser code** — it would be publicly visible
* Store keys in environment variables or a secrets manager (AWS Secrets Manager, HashiCorp Vault, etc.)
* Create separate keys for production and staging environments
* Revoke keys immediately if they are accidentally exposed

## Error responses

| Status             | Meaning                                                             |
| ------------------ | ------------------------------------------------------------------- |
| `401 Unauthorized` | `X-API-Key` header is missing                                       |
| `403 Forbidden`    | Key is invalid, revoked, or `site_id` does not match the key's site |