> ## Documentation Index
> Fetch the complete documentation index at: https://docs.prontiq.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> API key authentication for public Prontiq data endpoints.

## Public data API authentication

Every public Prontiq data API request requires an API key in the `X-Api-Key`
header.

```bash theme={null}
curl "https://api.prontiq.dev/v1/address/autocomplete?q=test" \
  -H "X-Api-Key: YOUR_API_KEY"
```

Create keys in the Prontiq console. Raw keys are revealed once, so copy the key
into your secret manager or server environment when it is created.

<Warning>
  Do not expose API keys in client-side code. Browser and mobile apps should
  call your backend, and your backend should call Prontiq.
</Warning>

## Server-side examples

<CodeGroup>
  ```typescript Node.js theme={null}
  const response = await fetch("https://api.prontiq.dev/v1/address/autocomplete?q=test", {
    headers: { "X-Api-Key": process.env.PRONTIQ_API_KEY ?? "" },
  });
  ```

  ```python Python theme={null}
  import os
  import requests

  response = requests.get(
      "https://api.prontiq.dev/v1/address/autocomplete",
      params={"q": "test"},
      headers={"X-Api-Key": os.environ["PRONTIQ_API_KEY"]},
  )
  ```
</CodeGroup>

## Missing key

If the `X-Api-Key` header is absent, the API returns `401 MISSING_API_KEY`.

```json theme={null}
{
  "error": {
    "code": "MISSING_API_KEY",
    "message": "Missing X-Api-Key header",
    "status": 401,
    "request_id": "req_abc123..."
  }
}
```

## Invalid key

If the key is unknown, inactive, or malformed, the API returns
`401 INVALID_API_KEY`.

```json theme={null}
{
  "error": {
    "code": "INVALID_API_KEY",
    "message": "Invalid API key",
    "status": 401,
    "request_id": "req_abc123..."
  }
}
```

## Product access

If your account is authenticated but does not have access to the requested API
family, the API returns `403 PRODUCT_NOT_ALLOWED`.

```json theme={null}
{
  "error": {
    "code": "PRODUCT_NOT_ALLOWED",
    "message": "Product not included in your plan",
    "status": 403,
    "request_id": "req_abc123...",
    "details": {
      "product": "address",
      "allowed": []
    }
  }
}
```

`details.product` is the API family requested by the route. `details.allowed`
contains the API families currently enabled for the key's account, so the
requested product is absent when this error is returned.

## Request IDs

Every response includes an `X-Request-Id` header. Error bodies also include the
same value as `error.request_id`. Include this id when contacting support.

## Console routes use Clerk, not API keys

Console account routes authenticate with a Clerk session token instead of
`X-Api-Key`. They are private console routes, not public data API routes, and
they are not included in the public API reference or public SDKs.

<Note>
  API-key authentication is separate from console authentication. Use API keys
  for public data API requests, and use the console for account and billing
  management.
</Note>