> ## Documentation Index
> Fetch the complete documentation index at: https://docs.slash.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> User API keys, the x-legal-entity header, and IP allowlisting.

Public API v2 authenticates with a **user API key**. Create one in the Slash
dashboard under
[Settings → API keys](https://app.slash.com/global-settings/api-keys), keep it
on your server, and send it on every request together with the legal entity
to act on:

```bash theme={null}
curl "https://api.slash.com/v2/accounts" \
  -H "X-API-Key: ${SLASH_API_KEY}" \
  -H "x-legal-entity: ${SLASH_LEGAL_ENTITY_ID}"
```

Never embed an API key in browser or mobile application code.

## User API keys

A user API key acts as the user who created it, with that user's current
access. Every action it performs has a human requester for authorization,
payment policies, and audit attribution.

Because a user can belong to several legal entities, the key is not tied to
one. Name the legal entity on every request with the `x-legal-entity` header.
The selected entity must be one the user can access; requests that omit the
header return `400 invalid_request`, and requests naming an entity the user
cannot access return `403 forbidden`.

A valid key does not imply access to every account, virtual account, contact,
or transaction. The key can only do what its user can do.

## Legal-entity API keys

Keys created under a legal entity's **API management** page are not accepted by
v2. A v2 request made with one returns `403 user_api_key_required`. Those keys
continue to work with the v1 API.

## IP allowlisting

Some sensitive routes require IP allowlisting to be enabled for the legal
entity. Requests to those routes must originate from an allowed IP address or
they return `403 forbidden`. The API Reference identifies routes with this
requirement.

## Authentication failures

A missing, invalid, or inactive API key returns `401 unauthorized`. An
authenticated key that cannot perform an action returns either `403 forbidden`
or an information-hiding `404 not_found`, depending on the resource boundary.
Do not use these responses to infer whether an inaccessible resource exists.