> ## Documentation Index
> Fetch the complete documentation index at: https://docs.my-virtual-office.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Learn how to authenticate with the My Virtual Office API

# Authentication

The My Virtual Office API uses API keys to authenticate requests. API keys are tied to your seller account and allow you to make requests on behalf of your account.

## Generating API Keys

1. Log in to your [My Virtual Office dashboard](https://app.my-virtual-office.com)
2. Navigate to **Settings** > **API Keys**
3. Click **Generate API Key**
4. Enter a name for your key (e.g., "Production API Key")
5. Optionally set an expiration date
6. Click **Generate Key**

<Warning>
  Your API key will only be shown once when it's created. Make sure to copy and store it securely before closing the dialog.
</Warning>

## Using API Keys

Include your API key in every request using one of these methods:

### X-API-Key Header (Recommended)

```bash theme={null}
curl -X POST https://app-api.my-virtual-office.com/api/customers \
  -H "X-API-Key: sk_live_your_api_key_here" \
  -H "Content-Type: application/json" \
  -d '{"first_name": "John", "last_name": "Doe", "email": "john@example.com"}'
```

### Authorization Bearer Header

```bash theme={null}
curl -X POST https://app-api.my-virtual-office.com/api/customers \
  -H "Authorization: Bearer sk_live_your_api_key_here" \
  -H "Content-Type: application/json" \
  -d '{"first_name": "John", "last_name": "Doe", "email": "john@example.com"}'
```

## API Key Format

API keys follow this format:

```
sk_live_XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
```

* `sk_live_` - Prefix identifying this as a live API key
* 48 random alphanumeric characters

## Key Security Best Practices

<AccordionGroup>
  <Accordion title="Never expose keys in client-side code">
    API keys should only be used in server-side code. Never include them in JavaScript that runs in the browser, mobile apps, or any publicly accessible code.
  </Accordion>

  <Accordion title="Use environment variables">
    Store your API keys in environment variables rather than hardcoding them in your application code.

    ```bash theme={null}
    # .env
    VIRTUAL_HUB_API_KEY=sk_live_your_api_key_here
    ```
  </Accordion>

  <Accordion title="Rotate keys periodically">
    Regularly generate new API keys and revoke old ones to minimize risk if a key is compromised.
  </Accordion>

  <Accordion title="Use separate keys for different environments">
    Create separate API keys for development, staging, and production environments.
  </Accordion>

  <Accordion title="Set expiration dates">
    For additional security, set expiration dates on your API keys and rotate them before they expire.
  </Accordion>
</AccordionGroup>

## Managing API Keys

From your dashboard, you can:

* **View** all your API keys (only the prefix is shown for security)
* **See** when each key was last used
* **Revoke** keys that are no longer needed or may be compromised
* **Delete** keys permanently

## Authentication Errors

| HTTP Code | Error        | Description              |
| --------- | ------------ | ------------------------ |
| 401       | Unauthorized | API key is missing       |
| 401       | Unauthorized | API key is invalid       |
| 401       | Unauthorized | API key has been revoked |
| 401       | Unauthorized | API key has expired      |

### Example Error Response

```json theme={null}
{
  "error": "Unauthorized",
  "message": "API key is required. Provide it via X-API-Key header or Authorization Bearer token."
}
```