> ## Documentation Index
> Fetch the complete documentation index at: https://docs.arqq.in/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> The Arqqin Parking Management API uses API key authentication for secure access to endpoints. All requests must include a valid API key in the request header.

## API Key Authentication

Include your API key in the `X-API-Key` header with every request:

<CodeGroup>
  ```bash cURL theme={null}
  curl -X GET "https://apistg.arqq.in/api/locations" \
    -H "X-API-Key: YOUR_API_KEY" \
    -H "Content-Type: application/json"
  ```

  ```javascript JavaScript theme={null}
  const response = await fetch('https://apistg.arqq.in/api/locations', {
    headers: {
      'X-API-Key': 'YOUR_API_KEY',
      'Content-Type': 'application/json'
    }
  });
  ```

  ```python Python theme={null}
  import requests

  headers = {
      'X-API-Key': 'YOUR_API_KEY',
      'Content-Type': 'application/json'
  }

  response = requests.get('https://apistg.arqq.in/api/locations', headers=headers)
  ```
</CodeGroup>

## Getting Your API Key

<Steps>
  <Step title="Contact Support">
    Send an email to [hello@arqqin.com](mailto:hello@arqqin.com) with your integration requirements and the locations you need access to.
  </Step>

  <Step title="Provide Details">
    Include your company information, use case, and the specific locations you'll be managing.
  </Step>

  <Step title="Receive Your Key">
    Our team will generate and provide you with an API key within 1-2 business days.
  </Step>
</Steps>

## API Key Security

<Warning>
  **Never expose your API key in client-side code or public repositories.** API keys provide full access to your whitelist data and should be treated as sensitive credentials.
</Warning>

### Security Best Practices

<Accordion title="Secure Storage">
  Store your API key securely:

  * Use environment variables in production
  * Never commit keys to version control
  * Rotate keys regularly
  * Use different keys for different environments
</Accordion>

<Accordion title="Request Security">
  Secure your API requests:

  * Always use HTTPS endpoints
  * Validate responses before processing
  * Implement proper error handling
  * Use rate limiting in your applications
</Accordion>

## API Key Scope

API keys are scoped to provide appropriate access for your use case:

* **Location Access**: Each API key provides access to designated locations
* **Permission-Based**: Keys are configured with appropriate permissions for your integration needs
* **Audit Trail**: All API usage is logged and auditable

<Info>
  Contact [hello@arqqin.com](mailto:hello@arqqin.com) to obtain your API key and configure the appropriate permissions for your use case.
</Info>

## Error Responses

### Invalid API Key

```json theme={null}
{
  "success": false,
  "error": {
    "code": "UNAUTHORIZED",
    "message": "Invalid or missing API key"
  }
}
```

### Missing API Key

```json theme={null}
{
  "success": false,
  "error": {
    "code": "UNAUTHORIZED", 
    "message": "API key is required"
  }
}
```

### Insufficient Permissions

```json theme={null}
{
  "success": false,
  "error": {
    "code": "FORBIDDEN",
    "message": "API key doesn't have access to requested resource"
  }
}
```

## Rate Limiting

API keys are subject to rate limiting to ensure fair usage:

* **Limit**: 1000 requests per hour per API key
* **Headers**: Rate limit information is included in response headers
* **Exceeded**: Requests exceeding the limit return a 429 status code

<CodeGroup>
  ```bash Response Headers theme={null}
  X-RateLimit-Limit: 1000
  X-RateLimit-Remaining: 999
  X-RateLimit-Reset: 1640995200
  ```

  ```json Rate Limit Exceeded theme={null}
  {
    "success": false,
    "error": {
      "code": "RATE_LIMIT_EXCEEDED",
      "message": "Too many requests"
    }
  }
  ```
</CodeGroup>

## Testing Authentication

You can test your API key authentication using the health check endpoint:

<CodeGroup>
  ```bash cURL theme={null}
  curl -X GET "https://apistg.arqq.in/api/health" \
    -H "X-API-Key: YOUR_API_KEY"
  ```

  ```javascript JavaScript theme={null}
  const response = await fetch('https://apistg.arqq.in/api/health', {
    headers: {
      'X-API-Key': 'YOUR_API_KEY'
    }
  });

  const data = await response.json();
  console.log(data); // Should return health status
  ```

  ```python Python theme={null}
  import requests

  headers = {'X-API-Key': 'YOUR_API_KEY'}
  response = requests.get('https://apistg.arqq.in/api/health', headers=headers)
  print(response.json())  # Should return health status
  ```
</CodeGroup>

## Need Help?

<CardGroup cols={2}>
  <Card title="Contact Support" icon="envelope" href="mailto:hello@arqqin.com">
    Get help with API key setup and authentication issues.
  </Card>

  <Card title="Quickstart Guide" icon="rocket" href="/quickstart">
    Learn how to make your first authenticated API calls.
  </Card>
</CardGroup>