# Authentication

Product Analytics uses public API keys. Use the key for the organization and environment you want to send data to.

## Get an API key

1. Open the **Product Analytics** catalog.
2. Open the **Details** tab.
3. In **Credentials**, copy an existing key, or create one if you manage API keys for the organization.

**Continue in Altertable:** [Open Altertable](/app)

## SDK authentication examples

Initialize your SDK once with the API key for the target environment:

### TypeScript

```typescript
import { altertable } from '@altertable/altertable-js';

altertable.init('{{API_KEY}}');
```

### React

```tsx
import { altertable } from '@altertable/altertable-js';
import { AltertableProvider } from '@altertable/altertable-react';

altertable.init('{{API_KEY}}');

export function App() {
  return (
    <AltertableProvider client={altertable}>
      {/* Your app */}
    </AltertableProvider>
  );
}
```

### Python

```python
from altertable import Altertable

client = Altertable("{{API_KEY}}")
```

### Ruby

```ruby
require 'altertable'

Altertable.init('{{API_KEY}}', {
  environment: '{{ENVIRONMENT_SLUG}}'
})
```

### Swift

```swift
import Altertable

let client = Altertable(apiKey: "{{API_KEY}}")
```

### Kotlin

```kotlin
import ai.altertable.sdk.Altertable

Altertable.setup {
    apiKey = "{{API_KEY}}"
    environment = "{{ENVIRONMENT_SLUG}}"
}
```

> **Note: SDK environment selection:**
>
> JavaScript and React SDKs v1.4.0 and later use the API key to select the environment. The `environment` configuration option is deprecated and ignored. Use separate keys for staging and production. Other SDKs may still require an explicit environment slug, as shown in their initialization examples.

## Direct API authentication

For direct HTTP requests, use the same API key as your SDKs.

| Method                 | How to send it                       | Notes                                                                                          |
| ---------------------- | ------------------------------------ | ---------------------------------------------------------------------------------------------- |
| `X-API-Key` header     | `X-API-Key: YOUR_API_KEY`            | Recommended for server-to-server requests.                                                     |
| `Authorization` header | `Authorization: Bearer YOUR_API_KEY` | Equivalent to `X-API-Key`; useful when your client already uses Bearer auth patterns.          |
| Query parameter        | `?apiKey=YOUR_API_KEY`               | Supported, but less preferred than headers because query strings are easier to leak into logs. |

> **Security guidance:**
>
> - API keys are ingestion keys for product events and user identification. They cannot read historical analytics data or modify existing records.
> - Prefer sending keys in headers. Use the query parameter form only when a header is not practical.

## Next steps

- **[Track events](/docs/ingest-data/product-analytics/track.md)**: Start sending product events
- **[Identify users](/docs/ingest-data/product-analytics/identify.md)**: Set up user identification