# Authentication

The API authenticates requests with an API key generated from your Sumtracker account.

## Send the API key

Pass the key in the `Authorization` header, prefixed with `Api-Key` and a space:

```http
Authorization: Api-Key YOUR_API_KEY
```

```bash
curl "https://inventory-api.sumtracker.com/api/version/2025-03/products/" \
  -H "Authorization: Api-Key YOUR_API_KEY"
```

Your API key identifies your Sumtracker account, so responses only ever contain your own data.
Keep the key secret and do not use it in browser or mobile code.

## In the API Reference playground

When the playground asks for **ApiKeyAuth**, enter the full header value including the prefix,
for example `Api-Key YOUR_API_KEY`.

## Rate limit

Each API key can make up to **5 requests per second**. Requests above the limit are rejected
with HTTP `429 Too Many Requests`. Wait briefly and retry.