# Authentication

> Authenticate Voice OTP API requests with a Bearer API key created in the Voice OTP dashboard.

Source: https://edesy.in/docs/voice-otp/getting-started/authentication

Every request needs an `Authorization` header with your API key:

```
Authorization: Bearer sk_your_api_key_here
```

The `X-API-Key: sk_your_api_key_here` header is also accepted.

Create, view and delete keys on the API Keys page of [voice-otp.edesy.in](https://voice-otp.edesy.in). The full key is shown only once, when you create it.

Treat the key like a password: keep it in an environment variable on your server and never ship it in a web or mobile app. Apps should call your own backend, which then calls Edesy. Requests with a missing or invalid key return `401`.