# Authentication

> Send your TwittrAPI key in the X-API-KEY header. What happens when the key is missing, unknown, deactivated or out of balance.

HTML page: https://www.twittrapi.com/docs/helpful-infos/authentication

Every request needs your API key in the `X-API-KEY` header. There is no OAuth flow and no X developer account involved.

```bash
curl 'https://api.twittrapi.com/simpletweet/20' \
  --header 'X-API-KEY: YOUR_API_KEY'
```

The key comes from the dashboard after you sign up on the [get started page](https://www.twittrapi.com/start). RapidAPI keys use different headers and a different host; see [Using RapidAPI instead](https://www.twittrapi.com/docs/getting-started#using-rapidapi-instead) and [Find your RapidAPI host](https://www.twittrapi.com/docs/getting-started#find-your-rapidapi-host).

## Keep the key secret

The key spends your balance. Keep it on the server side:

- Read it from an environment variable or a secret store. The SDKs read `TWITTRAPI_API_KEY`.
- Do not put it in browser or mobile app code, where anyone can extract it. Call the API from your backend instead.
- If a key leaks, use "Regenerate key" on the API key page of the dashboard. The old key stops working at once; balance and settings stay.

## Auth errors

These errors are not charged:

| Status | Body (`error`) | Meaning |
| --- | --- | --- |
| 401 | `missing api key` | No `X-API-KEY` header. |
| 401 | `invalid api key` | The key is not known. Check for typos and stray spaces. |
| 402 | `No balance left. Please top up to continue using the API.` | Your balance cannot cover the call. |
| 402 | `Your trial has expired. Please upgrade to continue using the API.` | The trial period ended before a top-up. |
| 403 | `This API key is deactivated. Please contact support.` | The key was turned off. |
| 403 | `This endpoint is not included in your plan.` | The key may not call this path. Trial keys cannot call `/client/*` and `/premium/*`. |

All error bodies are JSON objects with an `error` string. The full list is on [Errors](https://www.twittrapi.com/docs/helpful-infos/error-handling).

## Account actions need more than the key

The [account actions](https://www.twittrapi.com/docs/account-actions) (`/client/*`, `/premium/*`) act on your own X account. Besides the API key they need the cookie of your X session and your own proxy in the JSON body. Read endpoints need only the key.