> ## Documentation Index
> Fetch the complete documentation index at: https://docs.finsync.ar/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Understand when to use x-api-key authentication and when FinSync expects a bearer token.

# Authentication

FinSync currently documents two authentication modes in the OpenAPI spec.

## API key authentication

Most company-scoped endpoints expect an `x-api-key` header.

```bash theme={null}
curl --request GET \
  --url "https://finsync.ar/api/clients" \
  --header "x-api-key: YOUR_API_KEY"
```

Use API keys for routes such as:

* Client management
* Account and balance operations
* Operation creation and review
* Company transaction and operation type lookups

## Bearer authentication

Some superadmin routes expect a bearer token, typically a Supabase access token with the required allowlist checks.

```bash theme={null}
curl --request GET \
  --url "https://finsync.ar/api/superadmin/companies" \
  --header "Authorization: Bearer YOUR_ACCESS_TOKEN"
```

## Recommended practices

* Generate separate API keys per integration or environment.
* Never expose secrets in browser-only code or public repositories.
* Rotate keys if you suspect they were shared or logged.
* Check each endpoint's security requirements in the generated API reference because some routes override the global auth scheme.