# Authentication and account boundaries

Create an API key in **Developers → API Keys** while signed into the account and store you want to use. The secret is displayed at creation or regeneration. Keep it in your client’s private credential configuration.

Send one of these headers on every API request:

```http
X-API-Key: YOUR_STORE_API_KEY
```

```http
Authorization: Bearer YOUR_STORE_API_KEY
```


A key grants access to one account on one store. The server binds the account from the key; no developer request accepts an `accountId`, tenant, site or reseller selector. Use a reseller store's origin for its keys. A primary Reseller onboarding QA key is not a reseller-store key. Message requests require ownership of the associated order.


Unauthenticated or revoked keys fail authentication. A valid key presented to the wrong store also fails. Rotate the client configuration after regenerating a key.

[Documentation index](https://onboarding-qa.textverified.org/en/store-docs/index)