# Overview

> The Business API authenticates every request with an API key, and additionally with request signing, which is mandatory in production.

The Noah Business API uses both an **API Key** and **Request Signing** to authenticate requests, ensuring secure communication between your system and our API.

## Keys

There are three important security keys required to work with Noah's API:

| **Name**                      | **Description**                                                                      |
| ----------------------------- | ------------------------------------------------------------------------------------ |
| `API Key`                     | Used to identify and authenticate your requests.                                     |
| `Request Signing Private Key` | Used by your system to sign requests. **Never share this key.**                      |
| `Request Signing Public Key`  | Used when creating API Keys and later by our API for request signature verification. |

## Headers

Every request to our API must include the following headers:

| **Header**      | **Description**                                                                                                         |
| --------------- | ----------------------------------------------------------------------------------------------------------------------- |
| `X-Api-Key`     | Contains your API Key created in the Noah Dashboard.                                                                    |
| `Api-Signature` | Contains a JWT (JSON Web Token) with claims related to your request, signed using your **Request Signing Private Key**. |

:::warning[Security of your Funds]
Never send us nor share your **Request Signing Private Key**. It should be securely stored in your system and never exposed publicly.
:::

## Details

To get started with API keys and Request Signing Kets, see the below:

- [API Keys](api.md)
- [Request Signing Keys](signing.md)

## Error Handling

A `401 Unauthorized` HTTP status code will be returned in the following scenarios:

- **Missing Credentials:**
  - Requests made over plain HTTP.
  - Requests with missing `X-Api-Key` header.
- **Invalid Credentials:**
  - Requests with invalid or expired API Keys.
  - Requests with invalid or expired signed JWTs.
- **Environment Mismatch:**
  - Requests made using an API Key with a mismatched `env` value.
- **Signature Issues:**
  - Requests in `prod` with missing `Api-Signature` header.
  - Requests in `sandbox` with missing `Api-Signature` header when using an API Key associated with a **Request Signing Public Key**.
- **Unauthorized Access:**
  - Requests made from a browser using the `X-Api-Key` header.