> ## Documentation Index
> Fetch the complete documentation index at: https://docs.penelope.health/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

### API Key Authentication

Penelope uses API key authentication for secure access to the API. Each request must include your API key in the `x-api-key` header.

#### Obtaining Your API Key

Contact the Penelope team to receive your unique API key. Your key will be securely stored and validated.

#### Making Authenticated Requests

Include your API key in the `x-api-key` header for all API requests:

**Example Request**:

```bash theme={null}
curl -X GET https://api.penelope.health/v1/lobs \
  -H "x-api-key: your_api_key_here"
```

**Example with a Request Body**:

```bash theme={null}
curl -X POST "https://api.penelope.health/v1/policies/filter" \
  -H "x-api-key: your_api_key_here" \
  -H "Content-Type: application/json" \
  -d '{"policies": {"q": "diabetes"}, "limit": 10}'
```

#### Error Responses

**403 Forbidden** - Missing `x-api-key` header:

```json theme={null}
{
  "detail": "Not authenticated"
}
```

**401 Unauthorized** - Invalid API key:

```json theme={null}
{
  "detail": "Invalid API key"
}
```

#### Security Best Practices

* **Never expose your API key** in client-side code, public repositories, or logs
* Store API keys as environment variables or in secure configuration management systems
* **HTTPS required**: All requests must use HTTPS in production
* Contact the Penelope team immediately if your API key is compromised