# Authentication


<p style="font-size: 18px; color: #888; margin-top: 0;">Learn how to authenticate and start making requests.</p>

<p>All endpoints require authentication via <strong>API Key</strong>. We use the standard Bearer Authentication scheme. You must include your token in the <code>Authorization</code> header of every HTTP request.</p>

<hr style="border: 0; border-top: 1px solid rgba(128, 128, 128, 0.2); margin: 32px 0;" />

<h2>How to Authenticate</h2>
<ol>
    <li><strong>Obtain your Token:</strong> Log into your <strong>Dashboard</strong> to get your active API key.</li>
    <li><strong>Set the Header:</strong> Add the <code>Authorization</code> header to your request.</li>
    <li><strong>Format:</strong> The value must strictly follow the format: <code>Bearer &lt;your_token&gt;</code>.</li>
</ol>

<hr style="border: 0; border-top: 1px solid rgba(128, 128, 128, 0.2); margin: 32px 0;" />

<h2>Request Example</h2>

<p>Here is a standard example of how to construct your request headers to authorize an API call:</p>

```bash
curl --location --request POST 'https://api.lead.springbolt.app/lead/enrichment' \
--header 'Authorization: Bearer YOUR_API_KEY' \
--header 'Content-Type: application/json' \
--data-raw '{
  "linkedin_url": "https://www.linkedin.com/in/johndoe"
}'
```

<hr style="border: 0; border-top: 1px solid rgba(128, 128, 128, 0.2); margin: 32px 0;" />

<h2 id="security-best-practices">Security Best Practices</h2>

<div style="border-left: 4px solid rgba(128, 128, 128, 0.3); padding-left: 16px; margin-bottom: 24px;">
    <h4 style="margin: 0 0 8px 0;">Keep your API Key private</h4>
    <p style="margin: 0; color: #888;">Never expose your API key in client-side code, public repositories, or logs.</p>
</div>

<div style="border-left: 4px solid rgba(128, 128, 128, 0.3); padding-left: 16px; margin-bottom: 24px;">
    <h4 style="margin: 0 0 8px 0;">Use environment variables</h4>
    <p style="margin: 0; color: #888;">Store your key in environment variables (e.g. <code>SPRINGBOLT_API_KEY</code>) and inject it at runtime.</p>
</div>

<div style="border-left: 4px solid rgba(128, 128, 128, 0.3); padding-left: 16px; margin-bottom: 24px;">
    <h4 style="margin: 0 0 8px 0;">Rotate keys regularly</h4>
    <p style="margin: 0; color: #888;">Periodically regenerate your API key from the Dashboard to minimize exposure risk.</p>
</div>