---
title: "Authentication"
---
## API Keys

Every request to the Gravv API requires an `Api-Key`. After creating a Gravv account, we generate two pairs of API Keys for you: a publishable `Public Key` and a server-side `Secret Key`, for both [Sandbox and Live modes](/getting-started/environments).

Your API key identifies your business and environment. Gravv derives the tenant context from the key, so API clients must not send an `x-tenant-id` header.

To regenerate your API keys, click `Rotate API Key` in your Dashboard. Ensure you rotate your keys regularly to maintain security and prevent unauthorized access.

Keep your API keys secure and don't share them in GitHub repositories, client-side code, or any environment accessible to others.

Also, send all requests over HTTPS to protect sensitive data. Requests without valid authorization return a `401 `Unauthorized response.

### Obtain and use your API Keys

To obtain your API Key, follow these steps:

1. Sign in to your [Gravv Dashboard](https://app.gravv.xyz/) with your registered business email address.
2. Toggle `Sandbox` mode on for testing, or `Production` for live.
3. Click `Manage` in the side navigation.
4. Click `Configure` under the Manage section.
5. Now click `API keys`, then click the copy button under **Secret Key** to copy your `Secret Key`, or under **Public Key** to copy your `Public Key`.
6. Use the copied `Secret Key` as the `Api-Key` in your request header:

```bash title="sample request"
curl -X POST https://api.gravv.xyz/v1/customers \
  -H "Api-Key: <API_KEY>" \
  -H "Idempotency-Key: customer-<UUID>" \
  -H "Content-Type: application/json" \
  -d '{
    "first_name": "Jane",
    "last_name": "Doe",
    "middle_name": "Sample",
    "email": "jane.doe@example.com",
    "phone": "+15555550100",
    "type": "individual",
    "gender": "male",
    "date_of_birth": "2024-04-16",
    "address": {
      "address_line1": "Same Global Housing Estate",
      "city": "Lokogoma",
      "country": "NG",
      "postal_code": "900107",
      "state": "NG-FC"
    }
  }'

```

## Webhooks

For webhooks, you need to create them and generate their Secret Key:

1. Follow steps 1 through 3 in [Obtain your API Keys](/getting-started/onboard-your-first-customer#obtain-your-api-key).
2. Click `Webhooks` in the Dashboard.
3. Click `Create Webhook` to open the form.
4. Enter your webhook endpoint in the `Webhook URL` field.
5. Click `Generate` to create your webhook `Secret Key`.

You can regenerate your `Secret Key` at any time by clicking `Rotate API Key` in your Dashboard.