> ## Documentation Index
> Fetch the complete documentation index at: https://docs.mysubwallet.ng/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Generate your access token and authenticate API requests.

Authentication is a **two-step** process: exchange your account credentials for an **access token (API key)** once, then send that token with every subsequent request.

## Step 1 — Generate your access token

Send a `POST` request to `/api/user` with your account credentials encoded as **HTTP Basic Auth** (`base64(username:password)`).

<CodeGroup>
  ```bash cURL theme={null}
  curl -X POST "https://api.mysubwallet.ng/api/user" \
    -H "Authorization: Basic $(echo -n 'username:password' | base64)" \
    -H "Content-Type: application/json"
  ```

  ```js Node.js theme={null}
  const res = await fetch("https://api.mysubwallet.ng/api/user", {
    method: "POST",
    headers: {
      Authorization: "Basic " + Buffer.from("username:password").toString("base64"),
      "Content-Type": "application/json",
    },
  });
  const { AccessToken } = await res.json();
  ```

  ```python Python theme={null}
  import base64, requests

  cred = base64.b64encode(b"username:password").decode()
  res = requests.post(
      "https://api.mysubwallet.ng/api/user",
      headers={"Authorization": f"Basic {cred}", "Content-Type": "application/json"},
  )
  access_token = res.json()["AccessToken"]
  ```
</CodeGroup>

### Response

```json theme={null}
{
  "AccessToken": "your_access_token"
}
```

<Tip>
  Your `AccessToken` is your API key. Store it securely (e.g. an environment variable) and never expose it in client-side code.
</Tip>

## Step 2 — Authenticate your requests

Include the token in the **`Authorization`** header using the `Token` scheme on every API call:

```bash theme={null}
-H "Authorization: Token your_access_token"
```

<ParamField header="Authorization" type="string" required>
  `Token <your_access_token>` — your API key from Step 1.
</ParamField>

<Warning>
  Requests without a valid token return `401 Unauthorized`. Keep your key secret — anyone with it can spend your wallet balance.
</Warning>

## Live vs. sandbox keys

Your account has two keys (both on your [dashboard](https://app.mysubwallet.ng)):

* **Live key** — real transactions; your wallet is charged.
* **Sandbox key** (`sk_test_…`) — test mode; calls are simulated and never charge your wallet.

They authenticate identically — just swap the key. See [Sandbox & Test Mode](/sandbox).