---
title: API authentication
description: Authenticate OrbitRail Events requests with the X-OrbitRail-Key header.
url: https://pr-1-f831df687d6c.thally.app/api/authentication
---

# API authentication

Authenticate OrbitRail Events requests with the X-OrbitRail-Key header.

Send your OrbitRail API key in the `X-OrbitRail-Key` header on every request:

```bash
curl --request POST \
  --url https://events.orbitrail.example/v1/events \
  --header 'X-OrbitRail-Key: YOUR_API_KEY' \
  --header 'Content-Type: application/json' \
  --data '{"type":"shipment.ready","payload":{"shipmentId":"shp_123"}}'
```

Do not expose the key in browser code, commit it to a repository, or put it in a
URL. Rotate a key immediately if it appears in logs or source control.