> For the complete documentation index, see [llms.txt](https://docs.monolithforensics.com/monolith/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.monolithforensics.com/monolith/monolith-api-and-webhooks/api-access/authentication.md).

# Authentication

Authenticate requests to the Monolith API using an API key in the X-API-KEY request header.

Monolith API requests are authenticated using an API key.

API keys can be created and managed from **Settings > API** in Monolith.

### API Key Authentication

Include your API key in the following HTTP request header with each authenticated request:

```
X-API-KEY: your_api_key
```

The `X-API-KEY` header must contain a valid Monolith API key.

{% hint style="warning" %}
Treat API keys as sensitive credentials. Do not share them publicly, include them directly in source code, or store them in locations where they may be exposed.
{% endhint %}

### Create an API Key

To create an API key:

1. Open **Settings** in Monolith.
2. Select **API**.
3. Select **New API Key**.
4. Create the API key for the application, integration, script, or other approved workflow that will use it.

API keys can also be managed or revoked from the same page.

See [**API**](/monolith/using-monolith/settings/api.md) for more information about API key and Webhook management.

### Example API Request

The following Python example uses the [**Info API**](/monolith/monolith-api-and-webhooks/info-api.md) to verify that the API endpoint and API key are working correctly.

Replace the example API key and base URL with the values for your environment.

```python
import requests

# Set your Monolith API key.
# Store production API keys securely rather than directly in source code.
api_key = "YOUR_API_KEY"

# Set the API base URL for the Monolith environment where your tenant is hosted.
base_url = "https://monolith-app.monolithforensics.com/api/v1"

# Include the API key in the X-API-KEY request header.
headers = {
    "X-API-KEY": api_key
}

# Send a GET request to the Info API to verify API access.
response = requests.get(
    f"{base_url}/info",
    headers=headers
)

# Display the HTTP response status and returned JSON data.
print(response.status_code)
print(response.json())
```

Use the API base URL for the Monolith environment where your tenant is hosted.

See [**API Endpoints**](/monolith/monolith-api-and-webhooks/api-access/api-endpoints.md) for cloud-region and on-premises endpoint guidance.

### Verify API Access

A request to the Info endpoint provides a simple way to confirm that authentication is working:

```
GET /api/v1/info
```

A successful request returns basic information about the authenticated Monolith user and tenant.

See **Info API** for the documented response structure.

### Authentication Errors

If an API request is unsuccessful, verify that:

* The `X-API-KEY` header is included.
* The API key is valid and has not been revoked.
* The request is being sent to the correct Monolith environment.
* The endpoint path and HTTP method are correct.

Testing `GET /api/v1/info` can help separate an authentication or endpoint problem from an issue with a specific API resource.

### Related Documentation

* [**API Access**](/monolith/monolith-api-and-webhooks/api-access.md)
* [**API Endpoints**](/monolith/monolith-api-and-webhooks/api-access/api-endpoints.md)
* [**Info API**](/monolith/monolith-api-and-webhooks/info-api.md)
* [**API**](/monolith/using-monolith/settings/api.md)