> ## Documentation Index
> Fetch the complete documentation index at: https://docs.xapichina.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Create, store, and revoke secret XAPI China keys.

## API keys

Create a key from [Dashboard → API Keys](https://xapichina.com/dashboard/keys). Send it on authenticated data requests:

```http theme={"system"}
X-API-Key: xcn_YOUR_KEY
```

```bash theme={"system"}
curl --fail-with-body "https://api.xapichina.com/v1/me" \
  -H "X-API-Key: $XAPICHINA_API_KEY"
```

Use the API key header, rather than your dashboard session cookie or a query-string key. Dashboard login and public API authentication are separate flows.

## Public and authenticated routes

| Access | Endpoints |
| - | - |
| Public | `GET /v1/makes`, `GET /v1/filters` |
| Secret API key | Search, counts, model discovery, car details, photos, similar listings, inspection, insurance-event evidence, and `GET /v1/me` |

`GET /v1/me` identifies your account and current key without consuming data quota. Successful data requests count against the account's shared monthly allowance.

## Keep keys on your server

Store keys in server environment variables or a secret manager. Do not include them in frontend JavaScript, public repositories, screenshots, or customer-facing HTML.

Each key's full secret is shown only when it is created. If a key is lost or exposed, revoke it in the dashboard and create a replacement. All keys share the same account-wide rate limit and monthly quota.

## Authentication errors

A `401` means the key is missing, invalid, revoked, or attached to an inactive account. Verify the header and check key status in the dashboard before retrying.

See [errors and limits](/errors-and-limits) for `429` responses and production retry behavior.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.