> For the complete documentation index, see [llms.txt](https://docs.insurehero.io/shield-api/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.insurehero.io/shield-api/authorization/auth-api-overview.md).

# Auth API Overview

InsureHero's REST API uses a secure authentication mechanism to protect your data. Your API key is sent in the `x-api-key` header of the authorize endpoint, which returns an access token valid for 1 hour. Every other request sends that token in the `Authorization: Bearer <token>` header. The API key acts as a unique identifier and secure credential for obtaining access tokens.

As an organization committed to data security, it's crucial to handle API keys confidentially. Do not share them outside your organization or store them in publicly accessible areas like GitHub repositories or client-side code. Initially, you will receive access to our Sandbox environment for testing. Upon successful review, the production API key will be provided securely for live implementation.