---
title: "Authentication & credentials"
url: "https://dev.ionova.ai/authentication"
image: "https://dev.ionova.ai/_og/d/c_Ocean.takumi,title_~QXV0aGVudGljYXRpb24gJiBjcmVkZW50aWFscw,props_eyJ0aGVtZSI6eyJtb2RlIjoibGlnaHQiLCJjb2xvcnMiOnsicHJpbWFyeSI6IiMyRTUwOTAifX19,p_Ii9hdXRoZW50aWNhdGlvbiI,s_FqbkxRp7b_6pgl8t.png"
---

Authentication

# Two factors on every _call_.

Every request carries an OAuth bearer token _and_ an `X-API-Key`. Generate both yourself — test keys for the sandbox, live keys for production.

The two _factors_Sent on every endpoint, EP-01 through EP-27.

| Factor       | Header                        | What it is                                                        |
| :----------- | :---------------------------- | :---------------------------------------------------------------- |
| Bearer token | Authorization: Bearer <token> | Short-lived OAuth access token that identifies the caller.        |
| API key      | X-API-Key: <key>              | Long-lived account key that scopes the call to your subscription. |

bash · authenticated request

```bash
curl -X POST https://sandbox.ionova.io/ars/v4/check-party-address \
  -H "Authorization: Bearer $TOKEN" \
  -H "X-API-Key: $ARS_KEY" \
  -H "Content-Type: application/json" \
  -d '{"postalAddress":{"country":"DE","townName":"Berlin"}}'
```

Get your _keys_Self-service, from the developer dashboard.

1Create an accountRegister, then sign in to the developer portal. Your session unlocks the application and credentials screens.

2Register an applicationCreate an app to represent your integration. ARS issues a client credential pair scoped to it.

3Copy your X-API-KeyGrab the sandbox key first. Promote to a live key when you are ready for production traffic.

4Exchange for a tokenUse your client credentials to mint a short-lived bearer token, then call any endpoint.

**Sandbox vs live —** the sandbox base URL is `https://sandbox.ionova.io/ars/v4`; production is `https://api.ionova.io/ars/v4`. Test keys only resolve against the sandbox. Rotate or revoke a key at any time from the application screen — in-flight tokens expire on their own short TTL.

Where next

[Quickstart](https://dev.ionova.ai/get-started)[Channels](https://dev.ionova.ai/channels)[Errors & rate limits](https://dev.ionova.ai/reference/errors)[API reference](https://dev.ionova.ai/apis)