> ## Documentation Index
> Fetch the complete documentation index at: https://docs.zbx.boomfi.xyz/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Authenticate Merchants API requests with an API key and optional request signatures.

The Merchants API authenticates requests with an **API key**. Send the key on every request in the `X-API-KEY` header (OpenAPI security scheme `ApiKeyAuth`).

Some write endpoints also require **HMAC request signing** (`X-API-Nonce` and `X-API-Signature`). Those requirements are declared per operation in the interactive API reference.

## Create an API key

1. Open the merchant dashboard and go to **Settings → API & Webhook → API Keys**:
   `https://merchants.zbx.boomfi.xyz/dashboard/settings/api-keys`
2. Create a new key.
3. Copy the secret immediately and store it in a secrets manager.

<Warning>
  ZBX shows the full API key **once** at creation and cannot recover a lost key. Rotate (create a new key and revoke the old one) if it is leaked.
</Warning>

## Send the key

```bash theme={null}
curl "https://mapi.zbx.boomfi.xyz/v1/orgs" \
  -H "X-API-KEY: sk_test_xxx" \
  -H "Accept: application/json"
```

Keep keys out of client-side code, public repos, logs, and screenshots.

## Request signing (when required)

Permanent pay-in address creation and crypto payouts require HMAC request signing in addition to the API key. Other writes may only need `X-API-KEY`: check each operation in the API reference for `ApiNonce` / `ApiSignature`.

| Header            | Purpose                                      |
| ----------------- | -------------------------------------------- |
| `X-API-KEY`       | API key                                      |
| `X-API-Nonce`     | Unique value per request (replay protection) |
| `X-API-Signature` | Hex-encoded HMAC-SHA256 of the request       |

How the signature is built, how to fetch the signing secret, and a code sample are documented in the full guide: [Authentication](/authentication).

## Webhook verification is separate

Inbound webhooks use an **asymmetric** public key for payload verification: not the API key and not the HMAC request-signing secret. See [Verify Webhook Signatures](/webhooks/verify-signatures).

## Next

* [Response Patterns](/api/response-patterns)
* [API Overview](/api/overview)