# Authentication

Product Analytics uses public API keys. Every request is scoped to the organization that owns the key.

## Get an API key

1. Click on **API Keys** in the **Product Analytics** dashboard menu.
2. Copy the API key.

## SDK authentication examples

Initialize your SDK once with the API key for the current environment:

### TypeScript

```typescript
import { altertable } from '@altertable/altertable-js';

altertable.init('{{API_KEY}}', {
  environment: '{{ENVIRONMENT_SLUG}}',
});
```

### React

```tsx
import { altertable } from '@altertable/altertable-js';
import { AltertableProvider } from '@altertable/altertable-react';

altertable.init('{{API_KEY}}', {
  environment: '{{ENVIRONMENT_SLUG}}',
});

export function App() {
  return (
    <AltertableProvider client={altertable}>
      {/* Your app */}
    </AltertableProvider>
  );
}
```

### Python

```python
from altertable import Altertable

client = Altertable("{{API_KEY}}")
```

### Ruby

```ruby
require 'altertable'

Altertable.init('{{API_KEY}}', {
  environment: '{{ENVIRONMENT_SLUG}}'
})
```

### Swift

```swift
import Altertable

let client = Altertable(apiKey: "{{API_KEY}}")
```

### Kotlin

```kotlin
import ai.altertable.sdk.Altertable

Altertable.setup {
    apiKey = "{{API_KEY}}"
    environment = "{{ENVIRONMENT_SLUG}}"
}
```

## Direct API authentication

For direct HTTP requests, use the same API key as your SDKs.

| Method                 | How to send it                       | Notes                                                                                          |
| ---------------------- | ------------------------------------ | ---------------------------------------------------------------------------------------------- |
| `X-API-Key` header     | `X-API-Key: YOUR_API_KEY`            | Recommended for server-to-server requests.                                                     |
| `Authorization` header | `Authorization: Bearer YOUR_API_KEY` | Equivalent to `X-API-Key`; useful when your client already uses Bearer auth patterns.          |
| Query parameter        | `?apiKey=YOUR_API_KEY`               | Supported, but less preferred than headers because query strings are easier to leak into logs. |

> **Security guidance:**
>
> - API keys are ingestion keys for product events and user identification. They cannot read historical analytics data or modify existing records.
> - Prefer sending keys in headers. Use the query parameter form only when a header is not practical.

## Next steps

- **[Track events](/docs/product-analytics/ingest-data/track.md)**: Start sending product events
- **[Identify users](/docs/product-analytics/ingest-data/identify.md)**: Set up user identification