> ## Documentation Index
> Fetch the complete documentation index at: https://docs.getaptly.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> How to authenticate requests to the Aptly API.

Every request to the Aptly API must include a valid API key.

## API keys

API keys are created per company and work across all boards. A key must belong to a company that has the API enabled on the board being accessed.

To create a key:

1. Open the board in Aptly
2. Go to **Card Sources → API**
3. Toggle the API **on**
4. Click **Create New Key**, enter a name, and optionally set an expiration date
5. Copy the key — it won't be shown again

## Passing the key

<Tabs>
  <Tab title="Header (recommended)">
    ```bash theme={null}
    curl https://core-api.getaptly.com/api/board/{boardId}?page=0 \
      -H "x-token: YOUR_API_KEY"
    ```
  </Tab>

  <Tab title="Query parameter">
    ```bash theme={null}
    curl "https://core-api.getaptly.com/api/board/{boardId}?page=0&x-token=YOUR_API_KEY"
    ```
  </Tab>
</Tabs>

<Warning>
  **Core API and Portal API use different authentication schemes.**

  The Core API uses a static API key passed as an `x-token` header or query parameter. Everything on this page applies to the Core API only.

  The Portal API (`https://app.getaptly.com/api/portal`) uses JWT-based authentication scoped to a contact session. If you are building against the Portal API, refer to the [Contact Verification & Lightweight SSO](/contact-verification-sso) guide for how to obtain and pass a token.
</Warning>

## Error responses

| Status             | Meaning                                          |
| ------------------ | ------------------------------------------------ |
| `401 Unauthorized` | API key is missing, invalid, or expired          |
| `403 Forbidden`    | API access is not enabled for this board         |
| `404 Not Found`    | Board or card does not exist within your company |

## Key expiration

Keys can be created with or without an expiration date. Keys without an expiration remain active until archived. Expired or archived keys return `401`.